CVE-2020-8974 | In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware ver… | CVSS 10.0 CRITICAL

Description

In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.

Metadata

CVE ID: CVE-2020-8974
State: PUBLISHED
Assigner: INCIBE
Reserved: 2020-02-13 00:00 UTC
Published: 2022-10-17 21:16 UTC
Last updated: 2025-05-13 15:00 UTC
Primary CWE: CWE-434
CWE-434 Unrestricted Upload of File with Dangerous Type
Vendor / Product: ZGR / ZGR TPS200 NG
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ZGR	ZGR TPS200 NG	—	2.00 firmware version 2.00, 1.01 hardware version 1.01

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

References (1)

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zgr-tps200-ng