Vulnerability · Published Aug 25, 2020 · Assigned by twcert
CVE-2020-17384Cellopoint CelloOS - Remote Command Execution (RCE)
High 7.2
In plain English
A high-severity security flaw in CelloOS from Cellopoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.9%top 19.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cellopoint | CelloOS | 0 – through v4.1.10 Build 20190922 |
References
- https://www.twcert.org.tw/tw/cp-132-3845-be6bf-1.html x_refsource_MISC