CVE-2020-4060

In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message (https://doc.sm.tc/station/cupsproto.html#http-post-response) where the signature length is larger than 2 GByte (never happens in practice), or the response is crafted specifically to trigger this issue (i.e. the length signature field indicates a value larger than (2**31)-1 although the signature actually does not contain that much data). In such a scenario, on 32 bit machines, Basic Station would execute a code path, where a piece of memory is accessed after it has been freed, causing the process to crash and restarted again. The CUPS transaction is typically mutually authenticated over TLS. Therefore, in order to trigger this vulnerability, the attacker would have to gain access to the CUPS server first. If the user chose to operate without authentication over TLS but yet is concerned about this vulnerability, one possible workaround is to enable TLS authentication. This has been fixed in 2.0.4.

• CWE-416

• https://github.com/lorabasics/basicstation/security/advisories/GHSA-v9ph-r496-4m2jMitigation, Third Party Advisory
• https://github.com/lorabasics/basicstation/security/advisories/GHSA-v9ph-r496-4m2jMitigation, Third Party Advisory

Published

Jun 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4050In affected versions of WordPress, misuse of the `set-screen…3.1
• CVE-2020-4051In Dijit before versions 1.11.11, and greater than or equal …5.4
• CVE-2020-4052In Wiki.js before 2.4.107, there is a stored cross-site scri…6.1
• CVE-2020-4053In Helm greater than or equal to 3.0.0 and less than 3.2.4, …6.8
• CVE-2020-4054In Sanitize (RubyGem sanitize) greater than or equal to 3.0.…7.3
• CVE-2020-4059In mversion before 2.0.0, there is a command injection vulne…7.3
• CVE-2020-4061In October from version 1.0.319 and before version 1.0.467, …5.4
• CVE-2020-4062In Conjur OSS Helm Chart before 2.0.0, a recently identified…9
• CVE-2020-4066In Limdu before 0.95, the trainBatch function has a command …7.2
• CVE-2020-4067In coturn before version 4.5.1.3, there is an issue whereby …7.5
• CVE-2020-4068In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is l…9.8
• CVE-2020-4070In CSS Validator less than or equal to commit 54d68a1, there…5.4