CVE-2020-27691 - OpenCVE

The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Imomobile	Verve Connect Vh510 Verve Connect Vh510 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:imomobile:verve_connect_vh510_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:imomobile:verve_connect_vh510:l0am095a:*:*:*:*:*:*:*

References

Link	Resource
https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/	Third Party Advisory
https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-11-04T20:10:48

Updated: 2020-11-04T20:10:48

Reserved: 2020-10-23T00:00:00

Link: CVE-2020-27691

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-11-04T21:15:12.370

Modified: 2020-11-10T16:15:48.433

Link: CVE-2020-27691

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:imomobile:verve_connect_vh510_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "813E64BC-5EEB-4926-BF06-EC8D7B4B08D2", "versionEndExcluding": "1.0.1.6l0516", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:imomobile:verve_connect_vh510:l0am095a:*:*:*:*:*:*:*", "matchCriteriaId": "01A3A1E9-73E4-43DF-A02F-D977ACF46D77", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings."}, {"lang": "es", "value": "El dispositivo Relish (Verve Connect) VH510 con versiones de firmware anteriores a 1.0.1.6L0516, permite un ataque de tipo XSS por medio de URLBlocking Settings, SNMP Settings y System Log Settings"}], "id": "CVE-2020-27691", "lastModified": "2020-11-10T16:15:48.433", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-04T21:15:12.370", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}