cvelistv5 - CVE-2020-13712

CVE-2020-13712 (GCVE-0-2020-13712)

Vulnerability from cvelistv5 – Published: 2024-12-20 21:37 – Updated: 2024-12-26 19:29

Summary

A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected. MG90 running MGOS 4.2.1 or earlier is affected.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

SWI

References

URL

Tags

https://source.sierrawireless.com/-/media/support…

Impacted products

Vendor

Product

Version

Sierra Wireless

MGOS

Affected: all versions before 3.15.1 (Custom)

Sierra Wireless

MGOS

Affected: all versions before 4.2.1 (Custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-13712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-26T19:28:59.870255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-26T19:29:55.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "oMG2000"
          ],
          "product": "MGOS",
          "vendor": "Sierra Wireless",
          "versions": [
            {
              "status": "affected",
              "version": "all versions before 3.15.1",
              "versionType": "Custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MG90"
          ],
          "product": "MGOS",
          "vendor": "Sierra Wireless",
          "versions": [
            {
              "status": "affected",
              "version": "all versions before 4.2.1",
              "versionType": "Custom"
            }
          ]
        }
      ],
      "datePublic": "2020-11-19T21:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\nA command injection is possible through the user interface, allowing arbitrary command execution as \nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u0026nbsp;\n\nMG90 running MGOS 4.2.1 or earlier is affected.\u003c/p\u003e"
            }
          ],
          "value": "A command injection is possible through the user interface, allowing arbitrary command execution as \nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u00a0\n\nMG90 running MGOS 4.2.1 or earlier is affected."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Command Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-20T21:37:35.021Z",
        "orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
        "shortName": "SWI"
      },
      "references": [
        {
          "url": "https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MGOS Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e",
    "assignerShortName": "SWI",
    "cveId": "CVE-2020-13712",
    "datePublished": "2024-12-20T21:37:35.021Z",
    "dateReserved": "2020-06-01T00:00:00.000Z",
    "dateUpdated": "2024-12-26T19:29:55.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A command injection is possible through the user interface, allowing arbitrary command execution as \\nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\\u00a0\\n\\nMG90 running MGOS 4.2.1 or earlier is affected.\"}, {\"lang\": \"es\", \"value\": \"Es posible inyectar comandos a trav\\u00e9s de la interfaz de usuario, lo que permite la ejecuci\\u00f3n de comandos arbitrarios como superusuario. oMG2000 que ejecuta MGOS 3.15.1 o anterior se ve afectado. MG90 que ejecuta MGOS 4.2.1 o anterior se ve afectado.\"}]",
      "id": "CVE-2020-13712",
      "lastModified": "2024-12-26T20:15:19.377",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-12-20T22:15:23.327",
      "references": "[{\"url\": \"https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx\", \"source\": \"security@sierrawireless.com\"}]",
      "sourceIdentifier": "security@sierrawireless.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@sierrawireless.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-13712\",\"sourceIdentifier\":\"security@sierrawireless.com\",\"published\":\"2024-12-20T22:15:23.327\",\"lastModified\":\"2024-12-26T20:15:19.377\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A command injection is possible through the user interface, allowing arbitrary command execution as \\nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u00a0\\n\\nMG90 running MGOS 4.2.1 or earlier is affected.\"},{\"lang\":\"es\",\"value\":\"Es posible inyectar comandos a trav\u00e9s de la interfaz de usuario, lo que permite la ejecuci\u00f3n de comandos arbitrarios como superusuario. oMG2000 que ejecuta MGOS 3.15.1 o anterior se ve afectado. MG90 que ejecuta MGOS 4.2.1 o anterior se ve afectado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@sierrawireless.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"references\":[{\"url\":\"https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx\",\"source\":\"security@sierrawireless.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2020-13712\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-26T19:28:59.870255Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-26T19:29:46.422Z\"}}], \"cna\": {\"title\": \"MGOS Command Injection\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Command Injection\"}]}], \"affected\": [{\"vendor\": \"Sierra Wireless\", \"product\": \"MGOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"all versions before 3.15.1\", \"versionType\": \"Custom\"}], \"platforms\": [\"oMG2000\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Sierra Wireless\", \"product\": \"MGOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"all versions before 4.2.1\", \"versionType\": \"Custom\"}], \"platforms\": [\"MG90\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2020-11-19T21:36:00.000Z\", \"references\": [{\"url\": \"https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A command injection is possible through the user interface, allowing arbitrary command execution as \\nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\\u00a0\\n\\nMG90 running MGOS 4.2.1 or earlier is affected.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\\n\\nA command injection is possible through the user interface, allowing arbitrary command execution as \\nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u0026nbsp;\\n\\nMG90 running MGOS 4.2.1 or earlier is affected.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"747bec18-acd0-4d99-a5c8-5e366c66ab7e\", \"shortName\": \"SWI\", \"dateUpdated\": \"2024-12-20T21:37:35.021Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2020-13712\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-26T19:29:55.387Z\", \"dateReserved\": \"2020-06-01T00:00:00.000Z\", \"assignerOrgId\": \"747bec18-acd0-4d99-a5c8-5e366c66ab7e\", \"datePublished\": \"2024-12-20T21:37:35.021Z\", \"assignerShortName\": \"SWI\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2020-13712

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2020-13712

Aliases

CVE-2020-13712

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-13712",
    "id": "GSD-2020-13712"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-13712"
      ],
      "id": "GSD-2020-13712",
      "modified": "2023-12-13T01:21:47.373604Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2020-13712",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

GHSA-8G3G-85W5-QRM6

Vulnerability from github – Published: 2024-12-21 00:33 – Updated: 2024-12-26 21:30

Details

A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected.

MG90 running MGOS 4.2.1 or earlier is affected.

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-13712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-20T22:15:23Z",
    "severity": "HIGH"
  },
  "details": "A command injection is possible through the user interface, allowing arbitrary command execution as \nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u00a0\n\nMG90 running MGOS 4.2.1 or earlier is affected.",
  "id": "GHSA-8g3g-85w5-qrm6",
  "modified": "2024-12-26T21:30:36Z",
  "published": "2024-12-21T00:33:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13712"
    },
    {
      "type": "WEB",
      "url": "https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2020-13712

Vulnerability from fkie_nvd - Published: 2024-12-20 22:15 - Updated: 2024-12-26 20:15

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@sierrawireless.com	https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection is possible through the user interface, allowing arbitrary command execution as \nthe root user. oMG2000 running MGOS 3.15.1 or earlier is affected.\u00a0\n\nMG90 running MGOS 4.2.1 or earlier is affected."
    },
    {
      "lang": "es",
      "value": "Es posible inyectar comandos a trav\u00e9s de la interfaz de usuario, lo que permite la ejecuci\u00f3n de comandos arbitrarios como superusuario. oMG2000 que ejecuta MGOS 3.15.1 o anterior se ve afectado. MG90 que ejecuta MGOS 4.2.1 o anterior se ve afectado."
    }
  ],
  "id": "CVE-2020-13712",
  "lastModified": "2024-12-26T20:15:19.377",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-20T22:15:23.327",
  "references": [
    {
      "source": "security@sierrawireless.com",
      "url": "https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx"
    }
  ],
  "sourceIdentifier": "security@sierrawireless.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security@sierrawireless.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2020-13712 (GCVE-0-2020-13712)

GSD-2020-13712

GHSA-8G3G-85W5-QRM6

FKIE_CVE-2020-13712

Tags

Sightings

Nomenclature