CVE-2020-8963

TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

2.68% chance of exploitation in the next 30 days, 85th percentile

Published

2020-02-13

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html

References

• CVE Record
• NVD entry

Related

• CVE-2020-8958
• CVE-2020-8964
• CVE-2020-8956
• CVE-2020-8982
• CVE-2020-8950
• CVE-2020-8994