Details of VAR-202006-1005

ID

VAR-202006-1005

CVE

CVE-2020-14993

TITLE

plural DrayTek Out-of-bounds write vulnerabilities in product devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-007077

DESCRIPTION

A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbitrary code via the formuserphonenumber parameter in an authusersms action to mainfunction.cgi. Draytek Vigor2960 , Vigor3900 , Vigor300B The device is vulnerable to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. DrayTek Vigor3900, etc. are all products of DrayTek, Taiwan, China. DrayTek Vigor3900 is a broadband router/VPN gateway device. Vigor2960 is a load balancing router and VPN gateway device. Vigor300B is a load balancing router. There is a buffer overflow vulnerability in DrayTek Vigor2960, Vigor3900 and Vigor300B versions before 1.5.1.1

Trust: 2.16

sources: NVD: CVE-2020-14993 // JVNDB: JVNDB-2020-007077 // CNVD: CNVD-2021-21944

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-21944

AFFECTED PRODUCTS

vendor:	draytek	model:	vigor3900	scope:	lt	version:	1.5.1.1	Trust: 1.6
vendor:	draytek	model:	vigor2960	scope:	lt	version:	1.5.1.1	Trust: 1.6
vendor:	draytek	model:	vigor300b	scope:	lt	version:	1.5.1.1	Trust: 1.6
vendor:	draytek	model:	vigor2960	scope:	eq	version:	1.5.1.1	Trust: 0.8
vendor:	draytek	model:	vigor3900	scope:	eq	version:	1.5.1.1	Trust: 0.8

sources: CNVD: CNVD-2021-21944 // JVNDB: JVNDB-2020-007077 // NVD: CVE-2020-14993

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-14993
value:	CRITICAL
Trust: 1.0
NVD:	JVNDB-2020-007077
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2021-21944
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202006-1596
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2020-14993
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-007077
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2021-21944
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-14993
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-007077
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-21944 // JVNDB: JVNDB-2020-007077 // CNNVD: CNNVD-202006-1596 // NVD: CVE-2020-14993

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.8

sources: JVNDB: JVNDB-2020-007077 // NVD: CVE-2020-14993

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-1596

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202006-1596

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-007077

PATCH

title:	Vigor3900 / Vigor2960 / Vigor300B Stack-based buffer overflow Vulnerability (CVE-2020-14473 / CVE-2020-14993)	url:	https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-(cve-2020-14473)	Trust: 0.8
title:	DrayTek Security Advisory	url:	https://www.draytek.com/about/security-advisory	Trust: 0.8
title:	Patches for DrayTek Vigor2960, Vigor3900 and Vigor300B flushing area overflow vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/254556	Trust: 0.6

sources: CNVD: CNVD-2021-21944 // JVNDB: JVNDB-2020-007077

EXTERNAL IDS

db:	NVD	id:	CVE-2020-14993	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-007077	Trust: 0.8
db:	CNVD	id:	CNVD-2021-21944	Trust: 0.6
db:	CNNVD	id:	CNNVD-202006-1596	Trust: 0.6

sources: CNVD: CNVD-2021-21944 // JVNDB: JVNDB-2020-007077 // CNNVD: CNNVD-202006-1596 // NVD: CVE-2020-14993

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-14993	Trust: 2.0
url:	https://github.com/dexterone/vigor-poc	Trust: 1.6
url:	https://www.draytek.com/about/security-advisory	Trust: 1.6
url:	https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-%28cve-2020-14473%29	Trust: 1.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14993	Trust: 0.8
url:	https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability-(cve-2020-14473)	Trust: 0.6

sources: CNVD: CNVD-2021-21944 // JVNDB: JVNDB-2020-007077 // CNNVD: CNNVD-202006-1596 // NVD: CVE-2020-14993

SOURCES

db:	CNVD	id:	CNVD-2021-21944
db:	JVNDB	id:	JVNDB-2020-007077
db:	CNNVD	id:	CNNVD-202006-1596
db:	NVD	id:	CVE-2020-14993

LAST UPDATE DATE

2024-11-23T21:51:27.452000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-21944	date:	2021-04-13T00:00:00
db:	JVNDB	id:	JVNDB-2020-007077	date:	2020-07-30T00:00:00
db:	CNNVD	id:	CNNVD-202006-1596	date:	2020-06-30T00:00:00
db:	NVD	id:	CVE-2020-14993	date:	2024-11-21T05:04:35.537

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-21944	date:	2021-03-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-007077	date:	2020-07-30T00:00:00
db:	CNNVD	id:	CNNVD-202006-1596	date:	2020-06-23T00:00:00
db:	NVD	id:	CVE-2020-14993	date:	2020-06-23T12:15:13.503