CVE-2020-11920
Last modified
CVE-2020-11920 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. EPSS estimates a 4.19% chance of exploitation in the next 30 days.
Description
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code with root privileges (all of the device's services are running as root).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Svakom | Siime Eye Firmware | 14.1.00000001.3.330.0.0.3.14 |
References
- https://www.pentestpartners.com/security-blog/vulnerable-wi-fi-dildo-camera-endoscope-yes-really/Exploit, Third Party Advisory
- https://www.pentestpartners.com/security-blog/vulnerable-wi-fi-dildo-camera-endoscope-yes-really/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11920?
How severe is CVE-2020-11920?
How do I fix CVE-2020-11920?
Are you affected by CVE-2020-11920?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST