CVE-2020-13527

Published Dec 18, 2020

Last updated 2 years ago

Overview

Description
An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
Source
talos-cna@cisco.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
4.5
Impact score
3.6
Exploitability score
0.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Severity
MEDIUM

CVSS 3.0

Type
Secondary
Base score
4.8
Impact score
4.2
Exploitability score
0.5
Vector string
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
3.5
Impact score
2.9
Exploitability score
6.8
Vector string
AV:N/AC:M/Au:S/C:N/I:P/A:N

Weaknesses

nvd@nist.gov
CWE-352
talos-cna@cisco.com
CWE-352

Social media

Hype score
Not currently trending

Configurations