by Kastro
Paper/Archive/CVE-2020-13536

CVE-2020-13536

talos — An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality.

Affected

ProductAffectedFixed inSource
MoxaMoxa MXView Series 3.1.8–CNA

Scores by source

talos (CNA)9.3CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1148