Skip to content
OpenAdvisories
Critical ICSA-20-210-01 4 CVEs

Secomea GateManager

Published Jul 28, 2020 · Updated Jul 28, 2020

Vendor: Secomea Product: GateManager

Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to gain remote code execution on the device.

Vulnerabilities 4

  • Critical 10.0
    CVE-2020-14500

    IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158

    Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.

    Secomea GateManager all versions prior to 9.2c Secomea GateManager all versions prior to 9.2c
  • Critical 9.8
    CVE-2020-14510

    OFF-BY-ONE ERROR CWE-193

    GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.

    Secomea GateManager
  • High 8.1
    CVE-2020-14508

    OFF-BY-ONE ERROR CWE-193

    GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.

    Secomea GateManager
  • High 8.1
    CVE-2020-14512

    USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916

    GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.

    Secomea GateManager

Revision history

  1. #1

    ICSA-20-210-01 Secomea GateManager

References