CVE-2020-21999

Опубликовано: 04 мая 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.

Ссылки

https://www.exploit-db.com/exploits/47066
Exploit
Third Party Advisory
VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.php
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/47066
Exploit
Third Party Advisory
VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.php
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20286

Средний

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-gvmq-4gxq-mx44

github

больше 3 лет назад