CVE-2020-8234: Command Injection

Q: What is the vulnerability ID for this EdgeMax EdgeSwitch firmware vulnerability?

The vulnerability ID is CVE-2020-8234.

Q: What is the severity rating of CVE-2020-8234?

The severity rating of CVE-2020-8234 is critical with a severity value of 9.8.

Q: How can an attacker exploit CVE-2020-8234?

An attacker can exploit CVE-2020-8234 by guessing the EdgeSwitch legacy web interface SIDSSL cookie for admin, enabling them to obtain high privileges and execute a command injection to gain a root shell.

Q: What is the affected software for CVE-2020-8234?

The affected software for CVE-2020-8234 is The EdgeMax EdgeSwitch firmware prior to version 1.9.1.

Q: How can I fix the CVE-2020-8234 vulnerability?

To fix the CVE-2020-8234 vulnerability, update The EdgeMax EdgeSwitch firmware to version 1.9.1 or newer.

Published Aug 21, 2020

Updated

A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection.

Affected Software

12 affected components

UI Edgemax Firmware<1.9.1

UI Ep-s16

UI Es-12f

UI Es-16-150w

UI Es-16-xg

UI Es-24-250w

UI Es-24-500w

UI Es-24-lite

UI Es-48-500w

UI Es-48-750w

UI Es-48-lite

UI Es-8-150w

Remediation

Patch Available

https://community.ui.com/releases/Security-advisory-bulletin-014-014/1c32c056-2c64-4e60-ac23-ce7d8f387821,

Event History

Aug 21, 2020

CVE Published

via MITRE·08:37 PM

Data Sourced

via MITRE·08:37 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this EdgeMax EdgeSwitch firmware vulnerability?

The vulnerability ID is CVE-2020-8234.

What is the severity rating of CVE-2020-8234?

The severity rating of CVE-2020-8234 is critical with a severity value of 9.8.

How can an attacker exploit CVE-2020-8234?