by Kastro
Paper/Archive/CVE-2020-3936

CVE-2020-3936

Unisoon UltraLog Express — Unisoon UltraLog Express - SQL Injection

EPSS 1%CVSS 10.0
critical.is priorityof 100
44
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 69.4.694 × 2013.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.

Affected

ProductAffectedFixed inSource
UltraLog Express1.4.0–CNA
ultralog_express_firmware1.4.0–CISA-ADP

Scores by source

twcert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftwcert.org.tw/tw/cp-132-3451-7d9f0-1.html