CVE-2020-5569
Last modified
CVE-2020-5569 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREMIUM 3TB(HD-MB30TY, HD-MA30TY, HD-MB30TS, HD-MA30TS), CANVIO PREMIUM 2TB(HD-MB20TY, HD-MA20TY, HD-MB20TS, HD-MA20TS), CANVIO PREMIUM 1TB(HD-MB10TY, HD-MA10TY, HD-MB10TS, HD-MA10TS), CANVIO SLIM 1TB(HD-SB10TK, HD-SB10TS), and CANVIO SLIM 500GB(HD-SB50GK, HD-SA50GK, HD-SB50GS, HD-SA50GS), and which was downloaded before 2020 May 10. Since it registers Windows services with unquoted file paths, when a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREMIUM 3TB(HD-MB30TY, HD-MA30TY, HD-MB30TS, HD-MA30TS), CANVIO PREMIUM 2TB(HD-MB20TY, HD-MA20TY, HD-MB20TS, HD-MA20TS), CANVIO PREMIUM 1TB(HD-MB10TY, HD-MA10TY, HD-MB10TS, HD-MA10TS), CANVIO SLIM 1TB(HD-SB10TK, HD-SB10TS), and CANVIO SLIM 500GB(HD-SB50GK, HD-SA50GK, HD-SB50GS, HD-SA50GS), and which was downloaded before 2020 May 10. Since it registers Windows services with unquoted file paths, when a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Toshiba | Password Tool For Windows | <= 1.20.6620 |
References
- https://jvn.jp/en/jp/JVN13467854/index.htmlThird Party Advisory
- https://www.canvio.jp/news/20200420.htmVendor Advisory
- https://jvn.jp/en/jp/JVN13467854/index.htmlThird Party Advisory
- https://www.canvio.jp/news/20200420.htmVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5569?
How severe is CVE-2020-5569?
How do I fix CVE-2020-5569?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5563Improper authentication vulnerability in Cybozu Garoon 4.0.0…5.3
- CVE-2020-5564Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to…6.1
- CVE-2020-5565Improper input validation vulnerability in Cybozu Garoon 4.0…4.3
- CVE-2020-5566Improper authorization vulnerability in Cybozu Garoon 4.0.0 …4.3
- CVE-2020-5567Improper authentication vulnerability in Cybozu Garoon 4.0.0…7.5
- CVE-2020-5568Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to…6.1
- CVE-2020-5570Cross-site scripting vulnerability in Sales Force Assistant …5.4
- CVE-2020-5571SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and e…7.5
- CVE-2020-5572Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an …4.6
- CVE-2020-5573Android App 'kintone mobile for Android' 1.0.0 to 2.5 allows…4.6
- CVE-2020-5574HTML attribute value injection vulnerability in Movable Type…5.3
- CVE-2020-5575Cross-site scripting vulnerability in Movable Type series (M…6.1
Are you affected by CVE-2020-5569?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST