« Volver al listado

CVE-2020-13527

Estado: ModificadaMedia (4.5)—

An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Lantronix — SGX FirmwareLantronix — Xport Edge Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-13527",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 0.5
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Lantronix",
          "versions": [
            {
              "status": "affected",
              "version": "Lantronix XPort EDGE 3.0.0.0R11 Lantronix XPort EDGE 3.1.0.0R9 Lantronix XPort EDGE 3.4.0.0R12 Lantronix XPort EDGE 4.2.0.0R7 Lantronix SGX 5150 8.7.0.0R1 Lantronix SGX 5150 8.9.0.0R4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-18T00:15:14.047",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1135",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1135",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially crafted HTTP request can cause increased privileges. An attacker can send an HTTP request to trigger this vulnerability."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de omisión de autenticación en la funcionalidad Web Manager de Lantronix XPort EDGE versiones 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 y 4.2.0.0R7. Una petición HTTP especialmente diseñada puede causar privilegios elevados. Un atacante puede enviar una petición HTTP para desencadenar esta vulnerabilidad"
    }
  ],
  "lastModified": "2026-06-17T02:53:16.507",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lantronix:xport_edge_firmware:3.0.0.0:r11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DFAC926-7DFD-47AE-A850-BA6D04A85654"
            },
            {
              "criteria": "cpe:2.3:o:lantronix:xport_edge_firmware:3.1.0.0:r9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78DAC3A6-AD33-4D47-966D-B4AD1FBBA0C4"
            },
            {
              "criteria": "cpe:2.3:o:lantronix:xport_edge_firmware:3.4.0.0:r12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24141B2-6FC4-41EF-930A-148BE89E1BD0"
            },
            {
              "criteria": "cpe:2.3:o:lantronix:xport_edge_firmware:4.2.0.0:r7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "675A7F8D-7FCC-4CF5-ABA7-6D8D63E6F1EC"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lantronix:xport_edge:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9CBD6E79-A280-4AF1-9AE5-17E5F3F7D589"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lantronix:sgx_firmware:8.7.0.0:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F69E8E2E-0ADE-486A-8F3B-0EB45A5816A3"
            },
            {
              "criteria": "cpe:2.3:o:lantronix:sgx_firmware:8.9.0.0:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BCBE46D-B77A-4688-BF16-A50193D8DADF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lantronix:sgx:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "318554B0-354E-4B14-98C0-A604E2B42989"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}