CVE-2020-27542

Katalog CVE

CVSS 6.8 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada company cs-c2shw firmware. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (including network settings). The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command (without any escaping). So bash injection is possible. Camera doesn't parse QR codes if it's already successfully configured. Camera is always rebooted after successful configuration via QR code.

Rincian

Terbit di NVD

26 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dil4rd.medium.com/groundhog-day-in-iot-valley-or-5-cves-in-1-camera-7dc1d2864707 exploit · advisory pihak ketiga