VulnerabilityModified
CVE-2020-23161
Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.
MEDIUM 6.5EPSS 2.38%
Does this matter?
Lower severity and a low EPSS score (2.38%). Track it; it rarely justifies an emergency change on its own.
Description
Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.38% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- pyres/termod4 firmware
- Source
- cve@mitre.org
References
- https://github.com/Outpost24/Pyrescom-Termod-PoCExploit, Third Party Advisory
- https://outpost24.com/blog/multiple-vulnerabilities-discovered-in-Pyrescom-Termod4-smart-deviceExploit, Third Party Advisory
- https://pyres.com/en/solutions/termod-4/Product, Vendor Advisory
- https://github.com/Outpost24/Pyrescom-Termod-PoCExploit, Third Party Advisory
- https://outpost24.com/blog/multiple-vulnerabilities-discovered-in-Pyrescom-Termod4-smart-deviceExploit, Third Party Advisory
- https://pyres.com/en/solutions/termod-4/Product, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.