Vulnerability · Published Oct 17, 2022 · Assigned by INCIBE
CVE-2020-8974ZGR TPS200 NG Missing Reference to Active Allocated Resource
Critical 10.0
In plain English
A critical-severity unrestricted file upload in ZGR TPS200 NG from ZGR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZGR | ZGR TPS200 NG | 2.00 firmware version 2.001.01 hardware version 1.01 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H