Sign-up

ID

VAR-202009-0052


CVE

CVE-2020-10050


TITLE

SIMATIC RTLS Locating Manager  Inappropriate Default Permission Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-010866

DESCRIPTION

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts. SIMATIC RTLS Locating Manager Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SIMATIC RTLS is a real-time wireless positioning system for positioning solutions. Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installation

Trust: 2.16

sources: NVD: CVE-2020-10050 // JVNDB: JVNDB-2020-010866 // CNVD: CNVD-2020-51250

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-51250

AFFECTED PRODUCTS

vendor:siemensmodel:simatic rtls locating managerscope:ltversion:2.10.2

Trust: 1.6

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion:2.10.2

Trust: 0.8

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2020-51250 // JVNDB: JVNDB-2020-010866 // NVD: CVE-2020-10050

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-10050
value: HIGH

Trust: 1.0

NVD: CVE-2020-10050
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-51250
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202009-511
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-10050
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-51250
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-10050
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-10050
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-51250 // JVNDB: JVNDB-2020-010866 // CNNVD: CNNVD-202009-511 // NVD: CVE-2020-10050

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.0

problemtype:Inappropriate default permissions (CWE-276) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-010866 // NVD: CVE-2020-10050

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202009-511

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202009-511

PATCH

title:SSA-251935url:https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf

Trust: 0.8

title:Patch for Siemens SIMATIC RTLS Locating Manager Privilege Escalation Vulnerability (CNVD-2020-51250)url:https://www.cnvd.org.cn/patchInfo/show/233320

Trust: 0.6

title:ARC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=127930

Trust: 0.6

sources: CNVD: CNVD-2020-51250 // JVNDB: JVNDB-2020-010866 // CNNVD: CNNVD-202009-511

EXTERNAL IDS

db:NVDid:CVE-2020-10050

Trust: 3.8

db:SIEMENSid:SSA-251935

Trust: 2.2

db:ICS CERTid:ICSA-20-252-01

Trust: 1.4

db:JVNid:JVNVU94568336

Trust: 0.8

db:JVNDBid:JVNDB-2020-010866

Trust: 0.8

db:CNVDid:CNVD-2020-51250

Trust: 0.6

db:AUSCERTid:ESB-2020.3078

Trust: 0.6

db:NSFOCUSid:50589

Trust: 0.6

db:CNNVDid:CNNVD-202009-511

Trust: 0.6

sources: CNVD: CNVD-2020-51250 // JVNDB: JVNDB-2020-010866 // CNNVD: CNNVD-202009-511 // NVD: CVE-2020-10050

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf

Trust: 2.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-10050

Trust: 1.4

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-252-01

Trust: 1.4

url:https://jvn.jp/vu/jvnvu94568336/

Trust: 0.8

url:http://www.nsfocus.net/vulndb/50589

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3078/

Trust: 0.6

url:https://vigilance.fr/vulnerability/siemens-simatic-rtls-locating-manager-privilege-escalation-33284

Trust: 0.6

sources: CNVD: CNVD-2020-51250 // JVNDB: JVNDB-2020-010866 // CNNVD: CNNVD-202009-511 // NVD: CVE-2020-10050

SOURCES

db:CNVDid:CNVD-2020-51250
db:JVNDBid:JVNDB-2020-010866
db:CNNVDid:CNNVD-202009-511
db:NVDid:CVE-2020-10050

LAST UPDATE DATE

2024-08-14T13:05:19.601000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-51250date:2020-09-10T00:00:00
db:JVNDBid:JVNDB-2020-010866date:2022-03-11T06:10:00
db:CNNVDid:CNNVD-202009-511date:2020-11-17T00:00:00
db:NVDid:CVE-2020-10050date:2020-09-14T19:06:58.930

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-51250date:2020-09-09T00:00:00
db:JVNDBid:JVNDB-2020-010866date:2021-02-12T00:00:00
db:CNNVDid:CNNVD-202009-511date:2020-09-08T00:00:00
db:NVDid:CVE-2020-10050date:2020-09-09T19:15:18.413