CVE-2020-10514 - Vulnerability Details - OpenCVE

iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00408.

Key SSVC decision points have not yet been added.

Vendors	Products
Icatchinc	Dvr Firmware

Configuration 1 [-]

cpe:2.3:o:icatchinc:dvr_firmware:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

Update to the latest version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d
https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2020-04-15T06:20:24.071996Z

Updated: 2024-09-16T20:07:33.562Z

Reserved: 2020-03-12T00:00:00

Link: CVE-2020-10514

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-04-15T07:15:13.003

Modified: 2024-11-21T04:55:30.830

Link: CVE-2020-10514

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "DVR firmware", "vendor": "iCatch Inc.", "versions": [{"status": "affected", "version": "before 20200103"}]}], "datePublic": "2020-04-15T00:00:00", "descriptions": [{"lang": "en", "value": "iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-04-30T17:17:11", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html"}], "solutions": [{"lang": "en", "value": "Update to the latest version."}], "source": {"discovery": "UNKNOWN"}, "title": "iCatch DVR - Command Injection", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2020-04-15T05:30:00.000Z", "ID": "CVE-2020-10514", "STATE": "PUBLIC", "TITLE": "iCatch DVR - Command Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "DVR firmware", "version": {"version_data": [{"version_value": "before 20200103"}]}}]}, "vendor_name": "iCatch Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d", "refsource": "CONFIRM", "url": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d"}, {"name": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html", "refsource": "CONFIRM", "url": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html"}]}, "solution": [{"lang": "en", "value": "Update to the latest version."}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:06:09.954Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2020-10514", "datePublished": "2020-04-15T06:20:24.071996Z", "dateReserved": "2020-03-12T00:00:00", "dateUpdated": "2024-09-16T20:07:33.562Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:icatchinc:dvr_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7661F438-AB04-45F1-8771-D9BFF8978AE4", "versionEndExcluding": "20200103", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command."}, {"lang": "es", "value": "El firmware de iCatch DVR en versiones anteriores a la 20200103 no valida el par\u00e1metro de funci\u00f3n correctamente, por lo que los atacantes ejecutan comandos arbitrarios."}], "id": "CVE-2020-10514", "lastModified": "2024-11-21T04:55:30.830", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-15T07:15:13.003", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}