CVE-2020-27220: Critical severity eclipse hono vulnerability
The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27220?
CVE-2020-27220 is classified as a medium severity vulnerability.
How do I fix CVE-2020-27220?
To fix CVE-2020-27220, update to Eclipse Hono version 1.5.0 or later, where the vulnerability has been addressed.
Which versions of Eclipse Hono are affected by CVE-2020-27220?
Versions of Eclipse Hono from 1.4.0 to 1.4.4 and 1.5.0 are affected by CVE-2020-27220.
What type of devices are impacted by CVE-2020-27220?
Authenticated gateway devices using the AMQP and MQTT protocol adapters in Eclipse Hono are impacted by CVE-2020-27220.
What is the main issue described in CVE-2020-27220?
The main issue in CVE-2020-27220 is the lack of authorization checks for gateway devices receiving command and control messages.