CVE-2020-29059

high-risk
Published 2020-11-24

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default panger123 password for the suma123 account for certain old firmware.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

72408A Firmware
72408A Firmware
72408A Firmware
72408A Firmware
9008A Firmware
9008A Firmware
9008A Firmware
9008A Firmware
9016A Firmware
9016A Firmware
9016A Firmware
9016A Firmware
92408A Firmware
92408A Firmware
92408A Firmware
92408A Firmware
92416A Firmware
92416A Firmware
92416A Firmware
92416A Firmware

Affected Vendors

Cdatatec

References (2)

Exploit https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
Exploit https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
64
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 31/34 · Critical