critical9.8
CVE-2020-21994
AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotect…
Impact
AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful authentication bypass attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ave | Dominaplus | from 1.10.11 through 1.10.77 |
| Ave | 53ab-Wbs Firmware | Version 1.10.62 |
| Ave | Ts01 Firmware | Version 1.0.65 |
| Ave | Ts03x-V Firmware | Version 1.10.45a |
| Ave | Ts04x-V Firmware | Version 1.10.45a |
| Ave | Ts05 Firmware | Version 1.10.36 |
| Ave | Ts05n-V Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://cwe.mitre.org/data/definitions/522.html
- https://www.exploit-db.com/exploits/47819
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php
- https://cwe.mitre.org/data/definitions/522.html
- https://www.exploit-db.com/exploits/47819
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php