CVE-2020-24395

MEDIUM

6.8

Description

The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.

Details CVE

Score CVSS v3.16.8

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaquePHYSICAL

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/20/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

hom.ee:brain_cubehom.ee:brain_cube_core

Faiblesses (CWE)

CWE-345

References

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt(cve@mitre.org)

https://www.syss.de/pentest-blog/(cve@mitre.org)

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt(af854a3a-2127-422b-91ae-364da2661108)

https://www.syss.de/pentest-blog/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.