Vulnerability · Published Sep 23, 2020 · Assigned by tenable

CVE-2020-5781

Medium 4.3

In plain English

A medium-severity security flaw in IgniteNet HeliOS GLinq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.9%top 40.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users.

Affected products (as reported)

Vendor	Product	Versions
n/a	IgniteNet HeliOS GLinq	v2.2.1 r2961

References

https://www.tenable.com/security/research/tra-2020-55 x_refsource_MISC