Vulnerability Report

CVE-2020-15858

Title: Thalesgroup Bgs5 Path Traversal / LFI

Path Traversal / LFI

Proof Of Concept

No public PoC currently indexed for CVE-2020-15858.

CWE Category CWE-22
Published Date Aug 21, 2020
Modified Date Nov 21, 2024
Exploit Status Not Found
Score 6.2 CVSS v3.1
Exploit Probability (EPSS)
0.79%

Vulnerability Summary

CVE-2020-15858: Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04

Impacted Vendors

T
thalesgroup 9

Reference Links

http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html http://seclists.org/fulldisclosure/2023/Apr/11 https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modules http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html http://seclists.org/fulldisclosure/2023/Apr/11 https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modules
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.4
Attack Vector
PHYSICAL
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
6.2
Attack Vector
PHYSICAL
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CVSS v2.0
Source Entity [email protected]
Severity LOW
3.6
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:L/AC:L/Au:N/C:P/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-15858 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector PHYSICAL
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Stack

No specific products linked.