CVE-2020-7240: OS Command Injection
DISPUTED Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing the /config/netconf.cmd script (aka Extended Network Configuration). Note: According to the description, the vulnerability requires a fully authenticated super-user account using a webUI function that allows super users to edit a script supposed to execute OS commands. The given weakness enumeration (CWE-78) is not applicable in this case as it refers to abusing functions/input fields not supposed to be accepting OS commands by using 'Special Elements.'
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7240?
CVE-2020-7240 is a vulnerability that allows attackers with privileges to configure Meinberg Lantime M300 and M1000 devices to execute arbitrary OS commands by editing the /config/netconf.cmd script (aka Extended Network Configuration).
How severe is CVE-2020-7240?
CVE-2020-7240 has a severity value of 8.8, which is considered critical.
What software is affected by CVE-2020-7240?
The affected software includes Meinberg Lantime M300 Firmware and Meinberg Lantime M1000 Firmware.
How can I fix CVE-2020-7240?
To fix CVE-2020-7240, it is recommended to apply the necessary security patches or upgrades provided by Meinbergglobal.
Where can I find more information about CVE-2020-7240?
More information about CVE-2020-7240 can be found in the following references: [reference 1], [reference 2], [reference 3].