ByteOS Network

NVD Vulnerability Details :

CVE-2020-24033

Analyzed

Source-cve@mitre.org

Published At-22 Oct, 2020 | 14:15

Updated At-02 Nov, 2020 | 15:08

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

fs>>s3900_24t4s>>-

cpe:2.3:h:fs:s3900_24t4s:-:*:*:*:*:*:*:*

fs>>s3900_24t4s_firmware>>Versions up to 1.7.0(inclusive)

cpe:2.3:o:fs:s3900_24t4s_firmware:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-352	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/M0NsTeRRR/CVE-2020-24033	cve@mitre.org	Exploit Third Party Advisory
https://github.com/M0NsTeRRR/S3900-24T4S-CSRF-vulnerability	cve@mitre.org	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History