Directory Traversal Vulnerability in Thales DIS IoT Devices
CVE-2020-15858

6.2MEDIUM

Key Information:

Vendor

Thalesgroup

Status
Bgs5 Firmware
Vendor
CVE Published:
21 August 2020

What is CVE-2020-15858?

Thales DIS IoT devices, previously known as Gemalto and Cinterion, exhibit a directory traversal flaw that can be exploited by attackers in close physical proximity. This vulnerability allows unauthorized access to the internal flash file system, which may contain sensitive application data and critical resources required for functions like Java applications and over-the-air provisioning (OTAP). Affected models include several versions of BGS5, EHSx, PDSx, ELSx, and PLSx, opening potential risks for data exposure and unauthorized access.

References

https://www.thalesgroup.com/en/markets/digital-identity-a...
http://seclists.org/fulldisclosure/2023/Apr/11
mailing-list
http://packetstormsecurity.com/files/171978/Telit-Cinteri...

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.