CVE-2020-24034

Katalog CVE

CVSS 8.8 · High EPSS 3,7%

Kerentanan Deserialization of Untrusted Data pada sagemcom f@st 5280 router firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise.

Rincian

Terbit di NVD

1 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

3,7% peluang dieksploitasi; lebih tinggi dari 89,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sagemcom.com/fr/haut-debit advisory vendor
• http://packetstormsecurity.com/files/159026/Sagemcom-F-ST-5280-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Sep/3 mailing list · advisory pihak ketiga
• https://seclists.org/fulldisclosure/2020/Sep/3 mailing list · advisory pihak ketiga