Sign-up

ID

VAR-202009-0051


CVE

CVE-2020-10049


TITLE

SIMATIC RTLS Locating Manager  Inappropriate Default Permission Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-010865

DESCRIPTION

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system administrators. SIMATIC RTLS Locating Manager Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SIMATIC RTLS is a real-time wireless positioning system for positioning solutions. Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installation. Attackers can use vulnerabilities to execute arbitrary commands

Trust: 2.16

sources: NVD: CVE-2020-10049 // JVNDB: JVNDB-2020-010865 // CNVD: CNVD-2020-51251

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-51251

AFFECTED PRODUCTS

vendor:siemensmodel:simatic rtls locating managerscope:ltversion:2.10.2

Trust: 1.6

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion:2.10.2

Trust: 0.8

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2020-51251 // JVNDB: JVNDB-2020-010865 // NVD: CVE-2020-10049

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-10049
value: HIGH

Trust: 1.0

NVD: CVE-2020-10049
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-51251
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202009-513
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-10049
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-51251
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-10049
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-10049
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-51251 // JVNDB: JVNDB-2020-010865 // CNNVD: CNNVD-202009-513 // NVD: CVE-2020-10049

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.0

problemtype:Inappropriate default permissions (CWE-276) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-010865 // NVD: CVE-2020-10049

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202009-513

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202009-513

PATCH

title:SSA-251935url:https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf

Trust: 0.8

title:Patch for Siemens SIMATIC RTLS Locating Manager Privilege Escalation Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/233317

Trust: 0.6

title:ARC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=127932

Trust: 0.6

sources: CNVD: CNVD-2020-51251 // JVNDB: JVNDB-2020-010865 // CNNVD: CNNVD-202009-513

EXTERNAL IDS

db:NVDid:CVE-2020-10049

Trust: 3.8

db:SIEMENSid:SSA-251935

Trust: 2.2

db:ICS CERTid:ICSA-20-252-01

Trust: 1.4

db:JVNid:JVNVU94568336

Trust: 0.8

db:JVNDBid:JVNDB-2020-010865

Trust: 0.8

db:CNVDid:CNVD-2020-51251

Trust: 0.6

db:NSFOCUSid:50586

Trust: 0.6

db:AUSCERTid:ESB-2020.3078

Trust: 0.6

db:CNNVDid:CNNVD-202009-513

Trust: 0.6

sources: CNVD: CNVD-2020-51251 // JVNDB: JVNDB-2020-010865 // CNNVD: CNNVD-202009-513 // NVD: CVE-2020-10049

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf

Trust: 2.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10049

Trust: 1.4

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-252-01

Trust: 1.4

url:https://jvn.jp/vu/jvnvu94568336/

Trust: 0.8

url:http://www.nsfocus.net/vulndb/50586

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3078/

Trust: 0.6

url:https://vigilance.fr/vulnerability/siemens-simatic-rtls-locating-manager-privilege-escalation-33284

Trust: 0.6

sources: CNVD: CNVD-2020-51251 // JVNDB: JVNDB-2020-010865 // CNNVD: CNNVD-202009-513 // NVD: CVE-2020-10049

SOURCES

db:CNVDid:CNVD-2020-51251
db:JVNDBid:JVNDB-2020-010865
db:CNNVDid:CNNVD-202009-513
db:NVDid:CVE-2020-10049

LAST UPDATE DATE

2024-08-14T12:34:30.029000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-51251date:2020-09-10T00:00:00
db:JVNDBid:JVNDB-2020-010865date:2022-03-11T06:10:00
db:CNNVDid:CNNVD-202009-513date:2020-11-17T00:00:00
db:NVDid:CVE-2020-10049date:2020-09-14T19:09:10.297

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-51251date:2020-09-09T00:00:00
db:JVNDBid:JVNDB-2020-010865date:2021-02-12T00:00:00
db:CNNVDid:CNNVD-202009-513date:2020-09-08T00:00:00
db:NVDid:CVE-2020-10049date:2020-09-09T19:15:18.070