by Kastro
Paper/Archive/CVE-2020-8974

CVE-2020-8974

ZGR ZGR TPS200 NG — ZGR TPS200 NG Missing Reference to Active Allocated Resource

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.

Affected

ProductAffectedFixed inSource
ZGR TPS200 NG2.00 firmware version 2.00–CNA
ZGR TPS200 NG1.01 hardware version 1.01–CNA

Scores by source

INCIBE (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng