CVE-2020-8101 - OpenCVE

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:A/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Adt	Lifeshield Diy Hd Video Doorbell Lifeshield Diy Hd Video Doorbell Firmware

Configuration 1 [-]

AND

cpe:2.3:o:adt:lifeshield_diy_hd_video_doorbell_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:adt:lifeshield_diy_hd_video_doorbell:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Bitdefender

Published: 2021-02-02T11:10:14.062948Z

Updated: 2024-09-17T02:06:52.109Z

Reserved: 2020-01-28T00:00:00

Link: CVE-2020-8101

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-02-02T11:15:13.367

Modified: 2021-02-05T14:59:33.350

Link: CVE-2020-8101

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "LifeShield DIY HD Video Doorbell", "vendor": "ADT", "versions": [{"lessThanOrEqual": "1.0.02R09", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Bitdefender Labs"}], "datePublic": "2021-02-02T00:00:00", "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-02-02T11:10:13", "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/"}], "solutions": [{"lang": "en", "value": "A firmware update fixing the issue has been made available by the vendor."}], "source": {"discovery": "EXTERNAL"}, "title": "Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-requests@bitdefender.com", "DATE_PUBLIC": "2021-02-02T10:00:00.000Z", "ID": "CVE-2020-8101", "STATE": "PUBLIC", "TITLE": "Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "LifeShield DIY HD Video Doorbell", "version": {"version_data": [{"version_affected": "<=", "version_value": "1.0.02R09"}]}}]}, "vendor_name": "ADT"}]}}, "credit": [{"lang": "eng", "value": "Bitdefender Labs"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}]}, "references": {"reference_data": [{"name": "https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/", "refsource": "MISC", "url": "https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/"}]}, "solution": [{"lang": "en", "value": "A firmware update fixing the issue has been made available by the vendor."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:48:25.616Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/"}]}]}, "cveMetadata": {"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "assignerShortName": "Bitdefender", "cveId": "CVE-2020-8101", "datePublished": "2021-02-02T11:10:14.062948Z", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2024-09-17T02:06:52.109Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:adt:lifeshield_diy_hd_video_doorbell_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "27A31095-EA9C-4455-8510-2BC81EE32011", "versionEndIncluding": "1.0.02r09", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:adt:lifeshield_diy_hd_video_doorbell:-:*:*:*:*:*:*:*", "matchCriteriaId": "3429E58D-2DE8-426B-99A6-C118ED3EC12B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de Neutralizaci\u00f3n Inapropiada de Elementos Especiales usados en un Comando (\"Command Injection\") en la interfaz HTTP de ADT LifeShield DIY HD Video Doorbell, permite a un atacante en la misma red ejecutar comandos en el dispositivo. Este problema afecta a: ADT LifeShield DIY HD Video Doorbell versi\u00f3n 1.0.02R09 y versiones anteriores"}], "id": "CVE-2020-8101", "lastModified": "2021-02-05T14:59:33.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.7, "source": "cve-requests@bitdefender.com", "type": "Secondary"}]}, "published": "2021-02-02T11:15:13.367", "references": [{"source": "cve-requests@bitdefender.com", "tags": ["Third Party Advisory"], "url": "https://labs.bitdefender.com/2021/01/cracking-the-lifeshield-unauthorized-live-streaming-in-your-home/"}], "sourceIdentifier": "cve-requests@bitdefender.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "cve-requests@bitdefender.com", "type": "Secondary"}]}