CVE-2020-15858

Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04

• CWE-22

• http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html
• http://seclists.org/fulldisclosure/2023/Apr/11
• https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modulesVendor Advisory
• http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html
• http://seclists.org/fulldisclosure/2023/Apr/11
• https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modulesVendor Advisory

Published

Aug 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1585A remote code execution vulnerability exists in the way that…8.8
• CVE-2020-15850Insecure permissions in Nakivo Backup & Replication Director…7.8
• CVE-2020-15851Lack of access control in Nakivo Backup & Replication Transp…9.8
• CVE-2020-15852An issue was discovered in the Linux kernel 5.5 through 5.7.…7.8
• CVE-2020-15853supybot-fedora implements the command 'refresh', that refres…5.3
• CVE-2020-15855Two cross-site scripting vulnerabilities were fixed in Bodhi…6.1
• CVE-2020-15859QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c beca…3.3
• CVE-2020-15860Parallels Remote Application Server (RAS) 17.1.1 has a Busin…9.9
• CVE-2020-15861Net-SNMP through 5.7.3 allows Escalation of Privileges becau…7.8
• CVE-2020-15862Net-SNMP through 5.8 has Improper Privilege Management becau…7.8
• CVE-2020-15863hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU befo…5.3
• CVE-2020-15864An issue was discovered in Quali CloudShell 9.3. An XSS vuln…6.1