What is the CVSS score of CVE-2020-9436?

CVE-2020-9436 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.6%.

Is there a public PoC exploit available for CVE-2020-9436?

Yes, a public proof-of-concept exploit is available for CVE-2020-9436. Prioritise patching immediately. EPSS: 2.6%.

Tc Router 3002T 4G Firmware CVE-2020-9436

HIGH

OS Command Injection (CWE-78)

2020-03-12 cve@mitre.org

Command Injection Tc Router 3002T 4G Firmware Tc Router 2002T 3G Firmware Tc Router 3002T 4G Vzw Firmware Tc Router 3002T 4G Att Firmware Tc Cloud Client 1002 4G Firmware Tc Cloud Client 1002 Txtx Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 12, 2020 - 14:15 nvd

HIGH 8.8

DescriptionNVD

PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL.

AnalysisAI

PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL. Affected products include: Phoenixcontact Tc Router 3002T-4G Firmware, Phoenixcontact Tc Router 2002T-3G Firmware, Phoenixcontact Tc Router 3002T-4G Vzw Firmware, Phoenixcontact Tc Router 3002T-4G Att Firmware, Phoenixcontact Tc Cloud Client 1002-4G Firmware. Version information: through 2.05.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.