What is the CVSS score of CVE-2020-5357?

CVE-2020-5357 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Dock Wd15 Firmware CVE-2020-5357

MEDIUM

Uncontrolled Search Path Element (CWE-427)

2020-05-28 security_alert@emc.com

Dell Information Disclosure Dock Wd15 Firmware Dock Wd19 Firmware Thunderbolt Dock Tb16 Firmware Precision Dual Usb C Thunderbolt Dock Tb18Dc Firmware

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 28, 2020 - 20:15 nvd

MEDIUM 6.0

DescriptionNVD

Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.

AnalysisAI

Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. Rated medium severity (CVSS 6.0). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-427. Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers. Affected products include: Dell Dock Wd15 Firmware, Dell Dock Wd19 Firmware, Dell Thunderbolt Dock Tb16 Firmware, Dell Precision Dual Usb-C Thunderbolt Dock - Tb18Dc Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.