Details of VAR-202007-0769

ID

VAR-202007-0769

CVE

CVE-2020-15009

TITLE

ASUS PC for ScreenPad2_Upgrade_Tool.msi Unreliable search path vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2020-008829

DESCRIPTION

AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. ASUS PC for ScreenPad2_Upgrade_Tool.msi Exists in an unreliable search path vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. ASUS ScreenPad2 Upgrade Tool is an update tool for ASUS ScreenPad2 touchpad produced by ASUS, Taiwan, China. A code issue vulnerability exists in the AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe files in ASUS ScreenPad2 Upgrade Tool version 1.0.3. An attacker could exploit this vulnerability to execute code

Trust: 1.71

sources: NVD: CVE-2020-15009 // JVNDB: JVNDB-2020-008829 // VULHUB: VHN-167944

AFFECTED PRODUCTS

vendor:	asus	model:	screenpad2 upgrade tool	scope:	eq	version:	1.0.3	Trust: 1.0
vendor:	asustek computer	model:	screenpad2 upgrade tool	scope:	eq	version:	1.0.3	Trust: 0.8

sources: JVNDB: JVNDB-2020-008829 // NVD: CVE-2020-15009

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-15009
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-008829
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202007-1304
value:	HIGH
Trust: 0.6
VULHUB:	VHN-167944
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-15009
severity:	MEDIUM
baseScore:	4.4
vectorString:	AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.4
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-008829
severity:	MEDIUM
baseScore:	4.4
vectorString:	AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-167944
severity:	MEDIUM
baseScore:	4.4
vectorString:	AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.4
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-15009
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-008829
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-167944 // JVNDB: JVNDB-2020-008829 // CNNVD: CNNVD-202007-1304 // NVD: CVE-2020-15009

PROBLEMTYPE DATA

problemtype:

CWE-426

Trust: 1.9

sources: VULHUB: VHN-167944 // JVNDB: JVNDB-2020-008829 // NVD: CVE-2020-15009

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202007-1304

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202007-1304

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-008829

PATCH

title:	ASUS Product Security Advisory	url:	https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/	Trust: 0.8
title:	[UX450FDX / UX550GDX / UX550GEX] ASUS ScreenPad2.0 Upgrade Tool security update	url:	https://www.asus.com/support/FAQ/1043674	Trust: 0.8

sources: JVNDB: JVNDB-2020-008829

EXTERNAL IDS

db:	NVD	id:	CVE-2020-15009	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-008829	Trust: 0.8
db:	CNNVD	id:	CNNVD-202007-1304	Trust: 0.7
db:	CNVD	id:	CNVD-2022-04723	Trust: 0.1
db:	VULHUB	id:	VHN-167944	Trust: 0.1

sources: VULHUB: VHN-167944 // JVNDB: JVNDB-2020-008829 // CNNVD: CNNVD-202007-1304 // NVD: CVE-2020-15009

REFERENCES

url:	https://www.asus.com/static_webpage/asus-product-security-advisory/	Trust: 1.7
url:	https://www.asus.com/support/faq/1043674	Trust: 1.7
url:	https://drive.google.com/file/d/1clzhh5jw3pgzw74rvkrep8xu0tuc5ta0/view?usp=sharing	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-15009	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-15009	Trust: 0.8

sources: VULHUB: VHN-167944 // JVNDB: JVNDB-2020-008829 // CNNVD: CNNVD-202007-1304 // NVD: CVE-2020-15009

SOURCES

db:	VULHUB	id:	VHN-167944
db:	JVNDB	id:	JVNDB-2020-008829
db:	CNNVD	id:	CNNVD-202007-1304
db:	NVD	id:	CVE-2020-15009

LAST UPDATE DATE

2024-08-14T14:11:42.047000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-167944	date:	2020-07-29T00:00:00
db:	JVNDB	id:	JVNDB-2020-008829	date:	2020-09-28T00:00:00
db:	CNNVD	id:	CNNVD-202007-1304	date:	2020-07-31T00:00:00
db:	NVD	id:	CVE-2020-15009	date:	2020-07-29T16:03:16.663

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-167944	date:	2020-07-20T00:00:00
db:	JVNDB	id:	JVNDB-2020-008829	date:	2020-09-28T00:00:00
db:	CNNVD	id:	CNNVD-202007-1304	date:	2020-07-20T00:00:00
db:	NVD	id:	CVE-2020-15009	date:	2020-07-20T13:15:09.717