CVE-2020-27540

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Improper Verification of Cryptographic Signature pada company cs-c2shw firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card file vc\version.json. fw-sign parameter and from this configuration is directly inserted into a bash command. Firmware update is run automatically if there is special file on the inserted SD card.

Rincian

Terbit di NVD

26 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707 exploit · advisory pihak ketiga