Command Injection in ATOP Corporation products - CVE-2020-24552

Vulnerability identifier: #VU46679

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-24552

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

ATOP SE5901 series
ATOP SE5901B series
ATOP SE5904D series
ATOP SE5908 series
ATOP SE5908A series
ATOP SE5916 series
ATOP SE5916A series

Install updates from vendor's website.

ATOP SE5901 series - update to 1.51
ATOP SE5901B series - update to 1.51
ATOP SE5904D series - update to 1.51
ATOP SE5908 series - update to 1.51
ATOP SE5908A series - update to 1.51
ATOP SE5916 series - update to 1.51
ATOP SE5916A series - update to 1.51

• https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html

• Remote code execution in Atop Technology industrial 3G/4G gateway