CVE-2020-26122

Published: Dic 07, 2020 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2020-18752 Aliases: GSD-2020-26122
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
MEDIUM 6,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: single
Confidentiality: partial
Integrity: partial
Availability: partial

Description

AI Translation Available

Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism, the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0064
Percentile
0,7th
Updated

EPSS Score Trend (Last 91 Days)

347

Improper Verification of Cryptographic Signature

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Integrity Confidentiality
Potential Impacts:
Gain Privileges Or Assume Identity Modify Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
Operating System

Nf5260M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5260M5 Firmware
Version Range Affected
To 3.8.0 (exclusive)
cpe:2.3:o:inspur:nf5260m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5280M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5280M5 Firmware
Version Range Affected
To 4.26.6 (exclusive)
cpe:2.3:o:inspur:nf5280m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5180M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5180M5 Firmware
Version Range Affected
To 4.18.2 (exclusive)
cpe:2.3:o:inspur:nf5180m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5488M5-D Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5488M5-D Firmware
Version Range Affected
To 1.18.51 (exclusive)
cpe:2.3:o:inspur:nf5488m5-d_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5270M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5270M5 Firmware
Version Range Affected
To 4.9.1 (exclusive)
cpe:2.3:o:inspur:nf5270m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5466M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5466M5 Firmware
Version Range Affected
To 4.28.0 (exclusive)
cpe:2.3:o:inspur:nf5466m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5486M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5486M5 Firmware
Version Range Affected
To 3.22.0 (exclusive)
cpe:2.3:o:inspur:nf5486m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ns5162M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Ns5162M5 Firmware
Version Range Affected
To 4.5.3 (exclusive)
cpe:2.3:o:inspur:ns5162m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5266M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5266M5 Firmware
Version Range Affected
To 3.21.3 (exclusive)
cpe:2.3:o:inspur:nf5266m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ns5484M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Ns5484M5 Firmware
Version Range Affected
To 1.19.33 (exclusive)
cpe:2.3:o:inspur:ns5484m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ns5488M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Ns5488M5 Firmware
Version Range Affected
To 1.19.33 (exclusive)
cpe:2.3:o:inspur:ns5488m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf8260M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf8260M5 Firmware
Version Range Affected
To 1.19.34 (exclusive)
cpe:2.3:o:inspur:nf8260m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ns5482M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Ns5482M5 Firmware
Version Range Affected
To 1.19.33 (exclusive)
cpe:2.3:o:inspur:ns5482m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf5468M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf5468M5 Firmware
Version Range Affected
To 1.18.51 (exclusive)
cpe:2.3:o:inspur:nf5468m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Nf8480M5 Firmware by Inspur

Product Information
Vendor Inspur
Product Nf8480M5 Firmware
Version Range Affected
To 1.19.34 (exclusive)
cpe:2.3:o:inspur:nf8480m5_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://en.inspur.com/en/2487134/index.html
Broken Link
https://en.inspur.com/en/2487134/index.html
https://en.inspur.com/en/security_bulletins/security_adviso…
Vendor Advisory
https://en.inspur.com/en/security_bulletins/security_advisory2/2543921/index.ht…
https://en.inspur.com/en/2487134/index.html
Broken Link
https://en.inspur.com/en/2487134/index.html
https://en.inspur.com/en/security_bulletins/security_adviso…
Vendor Advisory
https://en.inspur.com/en/security_bulletins/security_advisory2/2543921/index.ht…