CVE-2020-13536CWE-276

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation

Critical · published November 5, 2020

CVSS v3.0
9.3
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality.

The record
Technical detail
CVSS v3.0
9.3 · CRITICAL
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2020-11-05T20:09Z
EPSS history
Timeline
  • 05 NOV 20:09Z
    An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation
    cvelistv5