A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote configuration of the device through the WebUI.
References
| Link | Resource |
|---|---|
| https://sra.io/blog-post/ | Broken Link |
| https://sra.io/blog/this-traversal-had-a-face-for-radio-cve-2020-17383/ | Exploit Patch Third Party Advisory |
| https://www.telosalliance.com/downloads?search=software-updates#downloadListing | Vendor Advisory |
| https://sra.io/blog-post/ | Broken Link |
| https://sra.io/blog/this-traversal-had-a-face-for-radio-cve-2020-17383/ | Exploit Patch Third Party Advisory |
| https://www.telosalliance.com/downloads?search=software-updates#downloadListing | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 05:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sra.io/blog-post/ - Broken Link | |
| References | () https://sra.io/blog/this-traversal-had-a-face-for-radio-cve-2020-17383/ - Exploit, Patch, Third Party Advisory | |
| References | () https://www.telosalliance.com/downloads?search=software-updates#downloadListing - Vendor Advisory |
Information
Published : 2022-01-24 20:15
Updated : 2024-11-21 05:07
NVD link : CVE-2020-17383
Mitre link : CVE-2020-17383
CVE.ORG link : CVE-2020-17383
JSON object : View
Products Affected
telosalliance
- z\/ip_one_firmware
- z\/ip_one
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')