CVE-2020-29056: OS Command Injection
Published Nov 24, 2020
·Updated
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. One can escape from a shell and acquire root privileges by leveraging the TFTP download configuration.
Affected Software
140 affected components
Cdatatec 72408a Firmware=1.2.2
Cdatatec 72408a Firmware=2.4.03_000
Cdatatec 72408a Firmware=2.4.04_001
Cdatatec 72408a Firmware=2.4.05_000
Cdatatec 72408a
Cdatatec 9008a Firmware=1.2.2
Cdatatec 9008a Firmware=2.4.03_000
Cdatatec 9008a Firmware=2.4.04_001
Cdatatec 9008a Firmware=2.4.05_000
Cdatatec 9008a
Cdatatec 9016a Firmware=1.2.2
Cdatatec 9016a Firmware=2.4.03_000
Cdatatec 9016a Firmware=2.4.04_001
Cdatatec 9016a Firmware=2.4.05_000
Cdatatec 9016a
Cdatatec 92408a Firmware=1.2.2
Cdatatec 92408a Firmware=2.4.03_000
Cdatatec 92408a Firmware=2.4.04_001
Cdatatec 92408a Firmware=2.4.05_000
Cdatatec 92408a
Cdatatec 92416a Firmware=1.2.2
Cdatatec 92416a Firmware=2.4.03_000
Cdatatec 92416a Firmware=2.4.04_001
Cdatatec 92416a Firmware=2.4.05_000
Cdatatec 92416a
Cdatatec 9288 Firmware=1.2.2
Cdatatec 9288 Firmware=2.4.03_000
Cdatatec 9288 Firmware=2.4.04_001
Cdatatec 9288 Firmware=2.4.05_000
Cdatatec 9288
Cdatatec 97016 Firmware=1.2.2
Cdatatec 97016 Firmware=2.4.03_000
Cdatatec 97016 Firmware=2.4.04_001
Cdatatec 97016 Firmware=2.4.05_000
Cdatatec 97016
Cdatatec 97024p Firmware=1.2.2
Cdatatec 97024p Firmware=2.4.03_000
Cdatatec 97024p Firmware=2.4.04_001
Cdatatec 97024p Firmware=2.4.05_000
Cdatatec 97024p
Cdatatec 97028p Firmware=1.2.2
Cdatatec 97028p Firmware=2.4.03_000
Cdatatec 97028p Firmware=2.4.04_001
Cdatatec 97028p Firmware=2.4.05_000
Cdatatec 97028p
Cdatatec 97042p Firmware=1.2.2
Cdatatec 97042p Firmware=2.4.03_000
Cdatatec 97042p Firmware=2.4.04_001
Cdatatec 97042p Firmware=2.4.05_000
Cdatatec 97042p
Cdatatec 97084p Firmware=1.2.2
Cdatatec 97084p Firmware=2.4.03_000
Cdatatec 97084p Firmware=2.4.04_001
Cdatatec 97084p Firmware=2.4.05_000
Cdatatec 97084p
Cdatatec 97168p Firmware=1.2.2
Cdatatec 97168p Firmware=2.4.03_000
Cdatatec 97168p Firmware=2.4.04_001
Cdatatec 97168p Firmware=2.4.05_000
Cdatatec 97168p
Cdatatec Fd1002s Firmware=1.2.2
Cdatatec Fd1002s Firmware=2.4.03_000
Cdatatec Fd1002s Firmware=2.4.04_001
Cdatatec Fd1002s Firmware=2.4.05_000
Cdatatec Fd1002s
CData Fd1104 Firmware=2.4.03_000
Cdatatec Fd1104 Firmware=1.2.2
Cdatatec Fd1104 Firmware=2.4.04_001
Cdatatec Fd1104 Firmware=2.4.05_000
Cdatatec Fd1104
Cdatatec Fd1104b Firmware=1.2.2
Cdatatec Fd1104b Firmware=2.4.03_000
Cdatatec Fd1104b Firmware=2.4.04_001
Cdatatec Fd1104b Firmware=2.4.05_000
Cdatatec Fd1104b
Cdatatec Fd1104s Firmware=1.2.2
Cdatatec Fd1104s Firmware=2.4.03_000
Cdatatec Fd1104s Firmware=2.4.04_001
Cdatatec Fd1104s Firmware=2.4.05_000
Cdatatec Fd1104s
Cdatatec Fd1104sn Firmware=1.2.2
Cdatatec Fd1104sn Firmware=2.4.03_000
Cdatatec Fd1104sn Firmware=2.4.04_001
Cdatatec Fd1104sn Firmware=2.4.05_000
Cdatatec Fd1104sn
Cdatatec Fd1108s Firmware=1.2.2
Cdatatec Fd1108s Firmware=2.4.03_000
Cdatatec Fd1108s Firmware=2.4.04_001
Cdatatec Fd1108s Firmware=2.4.05_000
Cdatatec Fd1108s
Cdatatec Fd1204s-r2 Firmware=1.2.2
Cdatatec Fd1204s-r2 Firmware=2.4.03_000
Cdatatec Fd1204s-r2 Firmware=2.4.04_001
Cdatatec Fd1204s-r2 Firmware=2.4.05_000
Cdatatec Fd1204s-r2
Cdatatec Fd1204sn Firmware=1.2.2
Cdatatec Fd1204sn Firmware=2.4.03_000
Cdatatec Fd1204sn Firmware=2.4.04_001
Cdatatec Fd1204sn Firmware=2.4.05_000
Cdatatec Fd1204sn
Cdatatec Fd1204sn-r2 Firmware=1.2.2
Cdatatec Fd1204sn-r2 Firmware=2.4.03_000
Cdatatec Fd1204sn-r2 Firmware=2.4.04_001
Cdatatec Fd1204sn-r2 Firmware=2.4.05_000
Cdatatec Fd1204sn-r2
Cdatatec Fd1208s-r2 Firmware=1.2.2
Cdatatec Fd1208s-r2 Firmware=2.4.03_000
Cdatatec Fd1208s-r2 Firmware=2.4.04_001
Cdatatec Fd1208s-r2 Firmware=2.4.05_000
Cdatatec Fd1208s-r2
Cdatatec Fd1216s-r1 Firmware=1.2.2
Cdatatec Fd1216s-r1 Firmware=2.4.03_000
Cdatatec Fd1216s-r1 Firmware=2.4.04_001
Cdatatec Fd1216s-r1 Firmware=2.4.05_000
Cdatatec Fd1216s-r1
Cdatatec Fd1608gs Firmware=1.2.2
Cdatatec Fd1608gs Firmware=2.4.03_000
Cdatatec Fd1608gs Firmware=2.4.04_001
Cdatatec Fd1608gs Firmware=2.4.05_000
Cdatatec Fd1608gs
Cdatatec Fd1608sn Firmware=1.2.2
Cdatatec Fd1608sn Firmware=2.4.03_000
Cdatatec Fd1608sn Firmware=2.4.04_001
Cdatatec Fd1608sn Firmware=2.4.05_000
Cdatatec Fd1608sn
Cdatatec Fd1616gs Firmware=1.2.2
Cdatatec Fd1616gs Firmware=2.4.03_000
Cdatatec Fd1616gs Firmware=2.4.04_001
Cdatatec Fd1616gs Firmware=2.4.05_000
Cdatatec Fd1616gs
Cdatatec Fd1616sn Firmware=1.2.2
Cdatatec Fd1616sn Firmware=2.4.03_000
Cdatatec Fd1616sn Firmware=2.4.04_001
Cdatatec Fd1616sn Firmware=2.4.05_000
Cdatatec Fd1616sn
Cdatatec Fd8000 Firmware=1.2.2
Cdatatec Fd8000 Firmware=2.4.03_000
Cdatatec Fd8000 Firmware=2.4.04_001
Cdatatec Fd8000 Firmware=2.4.05_000
Cdatatec Fd8000
Event History
Nov 24, 2020
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-29056?
The CVE-2020-29056 vulnerability has a high severity rating due to potential exploitation leading to unauthorized access.
2
How do I fix CVE-2020-29056?
To fix CVE-2020-29056, users should update the firmware of their affected CDATA devices to the latest secure version provided by the manufacturer.
3
What devices are affected by CVE-2020-29056?
CVE-2020-29056 affects multiple CDATA devices including models 72408A, 9008A, 9016A, and others listed in the vulnerability report.
4
What type of vulnerability is CVE-2020-29056?
CVE-2020-29056 is a remote code execution vulnerability that could allow an attacker to execute arbitrary commands on affected devices.
5
What should I do if I cannot update for CVE-2020-29056?
If unable to update for CVE-2020-29056, it is advisable to isolate the affected devices from the network and implement strict access controls.