by Kastro
Paper/Archive/CVE-2020-13537

CVE-2020-13537

talos — An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 45.4.454 × 209.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run.

Affected

ProductAffectedFixed inSource
MoxaMoxa MXView Series 3.1.8–CNA

Scores by source

talos (CNA)9.3CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1148