Vulnerability · Published Aug 25, 2020 · Assigned by twcert
CVE-2020-17385Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure
High 7.5
In plain English
A high-severity security flaw in CelloOS from Cellopoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 24.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cellopoint | CelloOS | 0 – through v4.1.10 Build 20190922 |
References
- https://www.twcert.org.tw/tw/cp-132-3846-7790c-1.html x_refsource_MISC