CVE-2020-8963

TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter.

Published: Feb 13, 2020
Updated: Apr 14, 2023
CVE: CVE-2020-8963
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-78

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
timetoolsltd / sr9850_firmware	1.0.007	1.0.007.x
timetoolsltd / sr9750_firmware	1.0.007	1.0.007.x
timetoolsltd / sc9705_firmware	1.0.007	1.0.007.x
timetoolsltd / sr9210_firmware	1.0.007	1.0.007.x
timetoolsltd / sc9205_firmware	1.0.007	1.0.007.x
timetoolsltd / sr7110_firmware	1.0.007	1.0.007.x
timetoolsltd / sc7105_firmware	1.0.007	1.0.007.x
timetoolsltd / t100_firmware	1.0.003	1.0.003.x
timetoolsltd / t300_firmware	1.0.003	1.0.003.x
timetoolsltd / t550_firmware	1.0.003	1.0.003.x

https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html

Vulnerability Database

290,206

CVE-2020-8963