Week 10, 2020
2–8 March 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-9054 ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgiEPSS 100%
-
Critical 9.8
CVE-2020-10189 Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage…EPSS 100%
- Critical 9.8 EPSS 73%
- Critical 9.8 EPSS 19%
- Critical 9.8 EPSS 18%
- Critical 9.8 EPSS 4.6%
-
Critical 9.8
CVE-2020-5328 Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licens…EPSS 1.4%
- Critical 9.1 EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-10220 An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.EPSS 100%
-
High 7.8
CVE-2019-20500 D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface…EPSS 97%
-
Unscored
CVE-2019-20499 D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interf…EPSS 95%
-
Unscored
CVE-2019-20501 D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, …EPSS 90%
-
Unscored
CVE-2020-10173 Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnost…EPSS 77%
-
High 8.8
CVE-2020-10221 lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName …EPSS 77%
-
Unscored
CVE-2020-10188 utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overf…EPSS 74%
- Medium 6.5 EPSS 69%
Advisories
- SUSE / openSUSE Security Updates 333 critical
- Debian Security (DSA / DLA) 72 critical
- Ubuntu Security Notices (USN) 61 critical
- CISA ICS & IT advisories 53 critical
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 3
- Amazon Linux Security Center (ALAS) 3
- CERT@VDE 1
- ICSA-20-063-04 Moxa AWK-3131A Series Industrial AP/Bridge/Client 12 CVEs
- ICSA-20-065-01 WAGO I/O-CHECK 9 CVEs
- DLA-2135-1 jackson-databind - security update 3 CVEs
- SUSE-SU-2020:0598-1 Security update for tomcat 3 CVEs
- DLA-2133-1 tomcat7 - security update 3 CVEs
- SUSE-SU-2019:3060-2 Security update for libpng16 2 CVEs
- ICSA-20-063-02 ICSA-20-063-02_PHOENIX CONTACT Emalytics Controller ILC 1 CVEs
- USN-4288-2 ppp vulnerability 1 CVEs
- openSUSE-SU-2020:0286-1 Security update for ppp 1 CVEs