by Kastro
Paper/Archive/CVE-2020-8976

CVE-2020-8976

ZGR ZGR TPS200 NG — ZGR TPS200 Cross-Site Request Forgery (CSRF)

EPSS 0.6%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 48.0.480 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request.

Affected

ProductAffectedFixed inSource
ZGR TPS200 NG2.00 firmware version 2.00–CNA
ZGR TPS200 NG1.01 hardware version 1.01–CNA

Scores by source

INCIBE (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refincibe-cert.es/en/early-warning/ics-advisories/multiple-vulnerabilities-zgr-tps200-ng