Log in Start free

Vulnerability · Published Sep 10, 2020 · Assigned by twcert

CVE-2020-24552Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway - Command Injection

Medium 5.5

In plain English

A medium-severity OS command injection in 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901 from Atop Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.4%top 28.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege.

Affected products (as reported)

VendorProductVersions
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901 1.18 – through 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5901B 1.18 – through 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5904D 1.18 – through 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908 1.18 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5908A 1.18 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916 1.18 1.4
Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway SE5916A 1.18 1.4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References