CVE-2020-8973CWE-284

ZGR TPS200 NG Improper access control

Critical · published October 17, 2022

CVSS v3.1
9.3
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

🚨 An attacker can hijack the ZGR TPS200 NG with a simple crafted request! This means they can change settings without even logging in. 🔥 Think of it like a hotel room key that lets anyone access the penthouse suite whenever they want, without actually being a guest. It's a huge risk, leaving the door wide open! With this vulnerability, a malicious user could alter critical parameters of the device, leading to unauthorized control over the entire system. Imagine someone rearranging the entire hotel layout while you’re not looking — chaotic and absolutely devastating! Immediate action is essential to secure your network.

Put simply

Think of it like a hotel room key that lets anyone access the penthouse suite whenever they want, without actually being a guest. It's a huge risk, leaving the door wide open! CVE-2020-8973 reveals a flaw in the ZGR TPS200 NG firmware version 2.00 and hardware version 1.01, allowing unauthorized access through improperly validated requests from the local network.

What to do

With this vulnerability, a malicious user could alter critical parameters of the device, leading to unauthorized control over the entire system. Imagine someone rearranging the entire hotel layout while you’re not looking — chaotic and absolutely devastating! Immediate action is essential to secure your network. Immediately update the firmware to the latest version provided by the manufacturer. Additionally, ensure that your network is adequately secured to limit unauthorized access. Regularly audit your network devices for vulnerabilities. You’ve got this! Follow these steps, and you’ll keep your system secure and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00478 · 40.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-10-17T21:17Z
EPSS history
Timeline
  • 17 OCT 21:17Z
    ZGR TPS200 NG Improper access control
    cvelistv5