CVE-2020-15809 — MEDIUM (6.5)

Q: How severe is CVE-2020-15809?

CVE-2020-15809 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2020-15809?

Check the references section above for vendor advisories and patch information. Affected products include: Spinetix Dsos, Spinetix Hmp350 Firmware, Spinetix Hmp350, Spinetix Hmp300 Firmware, Spinetix Hmp300.

Vulnerability Description

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Spinetix	Dsos	<= 4.5.2-1.0.2-1eb2ffbd
Spinetix	Hmp350 Firmware	<= 4.5.2-1.0.36229
Spinetix	Hmp350	-
Spinetix	Hmp300 Firmware	<= 4.5.2-1.0.36229
Spinetix	Hmp300	-
Spinetix	Diva Firmware	<= 4.5.2-1.0.36229
Spinetix	Diva	-
Spinetix	Hmp400 Firmware	<= 4.5.2-1.0.2-1eb2ffbd
Spinetix	Hmp400	-
Spinetix	Hmp400W Firmware	<= 4.5.2-1.0.2-1eb2ffbd
Spinetix	Hmp400W	-

Related Weaknesses (CWE)

CWE-22 CWE-918

References

https://support.spinetix.com/wiki/DSOS_release_notesRelease NotesVendor Advisory
https://support.spinetix.com/wiki/SpinetiX-SA-20:01Release NotesVendor Advisory
https://support.spinetix.com/wiki/DSOS_release_notesRelease NotesVendor Advisory
https://support.spinetix.com/wiki/SpinetiX-SA-20:01Release NotesVendor Advisory

FAQ

What is CVE-2020-15809?

CVE-2020-15809 is a vulnerability with a CVSS score of 6.5 (MEDIUM). spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP...

How severe is CVE-2020-15809?

CVE-2020-15809 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-15809?

Check the references section above for vendor advisories and patch information. Affected products include: Spinetix Dsos, Spinetix Hmp350 Firmware, Spinetix Hmp350, Spinetix Hmp300 Firmware, Spinetix Hmp300.