Week 13, 2020
23–29 March 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-5722 The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use thi…EPSS 84%
-
Critical 9.8
CVE-2020-10826 /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTT…EPSS 39%
- Critical 9.8 EPSS 23%
-
Critical 9.8
CVE-2020-10828 A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via…EPSS 21%
-
Critical 9.8
CVE-2020-10827 A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via…EPSS 21%
-
Critical 9.8
CVE-2020-8868 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required t…EPSS 9.5%
-
Critical 9.8
CVE-2020-10881 This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen…EPSS 9.4%
- Critical 9.8 EPSS 5.4%
-
Critical 9.8
CVE-2020-10823 A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote …EPSS 4.4%
-
Critical 9.8
CVE-2020-10825 A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5…EPSS 4.1%
-
Critical 9.8
CVE-2020-10824 A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remo…EPSS 4.1%
-
Critical 9.8
CVE-2020-6072 An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS me…EPSS 3.8%
- Critical 9.8 EPSS 2.3%
- Critical 10.0 EPSS 1.2%
- Critical 9.1 EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-10879 rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the…EPSS 84%
-
High 8.8
CVE-2020-8864 This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi…EPSS 82%
-
High 8.8
CVE-2020-8863 This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi…EPSS 78%
-
High 8.8
CVE-2020-10882 This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 route…EPSS 41%
-
High 8.1
CVE-2020-10884 This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers.…EPSS 39%
-
Unscored
CVE-2020-10931 Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binar…EPSS 28%
-
Unscored
CVE-2020-9375 TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexp…EPSS 27%
-
Unscored
CVE-2020-9467 Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 292 critical
- Debian Security (DSA / DLA) 10
- Oracle Linux Security Advisories (ELSA) 5
- Ubuntu Security Notices (USN) 5
- Amazon Linux Security Center (ALAS) 4
- BSI CERT-Bund (WID) 4
- CISA ICS & IT advisories 31 critical
- CERT@VDE 2
- ICSA-20-084-01 VISAM Automation Base (VBASE) (Update B) 5 CVEs
- SUSE-SU-2020:0806-1 Security update for tomcat 1 CVEs
- SUSE-SU-2020:14334-1 Security update for tomcat6 1 CVEs