CVE-2020-8964
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie."
Los dispositivos TimeTools SC7105 versiones 1.0.007, SC9205 versiones 1.0.007, SC9705 versiones 1.0.007, SR7110 versiones 1.0.007, SR9210 versiones 1.0.007, SR9750 versiones 1.0.007, SR9850 versiones 1.0.007, T100 versiones 1.0.003, T300 versiones 1.0.003 y T550 versiones 1.0.003, permiten a atacantes remotos omitir la autenticación colocando t3axs=TiMEtOOlsj7G3xMm52wB en una petición del archivo t3.cgi, también se conoce como "hardcoded cookie".
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-02-13 CVE Reserved
- 2020-02-13 CVE Published
- 2024-01-19 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-798: Use of Hard-coded Credentials
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Timetoolsltd Search vendor "Timetoolsltd" | Sr9850 Firmware Search vendor "Timetoolsltd" for product "Sr9850 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sr9850 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sr9850 Search vendor "Timetoolsltd" for product "Sr9850" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sr9750 Firmware Search vendor "Timetoolsltd" for product "Sr9750 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sr9750 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sr9750 Search vendor "Timetoolsltd" for product "Sr9750" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sc9705 Firmware Search vendor "Timetoolsltd" for product "Sc9705 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sc9705 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sc9705 Search vendor "Timetoolsltd" for product "Sc9705" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sr9210 Firmware Search vendor "Timetoolsltd" for product "Sr9210 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sr9210 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sr9210 Search vendor "Timetoolsltd" for product "Sr9210" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sc9205 Firmware Search vendor "Timetoolsltd" for product "Sc9205 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sc9205 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sc9205 Search vendor "Timetoolsltd" for product "Sc9205" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sr7110 Firmware Search vendor "Timetoolsltd" for product "Sr7110 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sr7110 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sr7110 Search vendor "Timetoolsltd" for product "Sr7110" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | Sc7105 Firmware Search vendor "Timetoolsltd" for product "Sc7105 Firmware" | 1.0.007 Search vendor "Timetoolsltd" for product "Sc7105 Firmware" and version "1.0.007" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | Sc7105 Search vendor "Timetoolsltd" for product "Sc7105" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | T100 Firmware Search vendor "Timetoolsltd" for product "T100 Firmware" | 1.0.003 Search vendor "Timetoolsltd" for product "T100 Firmware" and version "1.0.003" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | T100 Search vendor "Timetoolsltd" for product "T100" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | T300 Firmware Search vendor "Timetoolsltd" for product "T300 Firmware" | 1.0.003 Search vendor "Timetoolsltd" for product "T300 Firmware" and version "1.0.003" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | T300 Search vendor "Timetoolsltd" for product "T300" | - | - |
Safe
|
| Timetoolsltd Search vendor "Timetoolsltd" | T550 Firmware Search vendor "Timetoolsltd" for product "T550 Firmware" | 1.0.003 Search vendor "Timetoolsltd" for product "T550 Firmware" and version "1.0.003" | - |
Affected
| in | Timetoolsltd Search vendor "Timetoolsltd" | T550 Search vendor "Timetoolsltd" for product "T550" | - | - |
Safe
|