CVE-2020-14500 : Secomea GateManager all versions prior to 9.2c, An attacker can send a negative

Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.

Published 2020-08-25 14:15:16

Updated 2020-09-02 13:48:09

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2020-14500

Secomea » Gatemanager 8250 Firmware » Version: 9.2c
cpe:2.3:o:secomea:gatemanager_8250_firmware:9.2c:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Gatemanager 8250 » Version: N/A

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-158 Improper Neutralization of Null Byte or NUL Character

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Assigned by: ics-cert@hq.dhs.gov (Secondary)
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

Assigned by: nvd@nist.gov (Primary)

Jump to