CVE-2020-25189 - OpenCVE

The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09).

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Paradox	Ip150 Firmware Ip150

Configuration 1 [-]

AND

cpe:2.3:o:paradox:ip150_firmware:5.02.09:*:*:*:*:*:*:*

cpe:2.3:h:paradox:ip150:-:*:*:*:*:*:*:*

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2020-11-21T16:58:42

Updated: 2020-11-21T16:58:42

Reserved: 2020-09-04T00:00:00

Link: CVE-2020-25189

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-11-21T17:15:10.757

Modified: 2020-12-03T15:52:32.730

Link: CVE-2020-25189

JSON object: View

Redhat Information

No data.

CWE

CWE-121

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:paradox:ip150_firmware:5.02.09:*:*:*:*:*:*:*", "matchCriteriaId": "0ED59B14-9DB1-47AB-8055-7EF9725C0295", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:paradox:ip150:-:*:*:*:*:*:*:*", "matchCriteriaId": "D1779BAC-FF0D-43FC-BFBC-A6164072A248", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09)."}, {"lang": "es", "value": "El producto afectado es vulnerable a tres desbordamientos de b\u00fafer en la regi\u00f3n stack de la memoria , lo que puede permitir a un atacante no autenticado ejecutar remotamente c\u00f3digo arbitrario en el IP150 (versiones de firmware 5.02.09)"}], "id": "CVE-2020-25189", "lastModified": "2020-12-03T15:52:32.730", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-21T17:15:10.757", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-324-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}