Vulnerability Details CVE-2020-12651
SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INT_MAX.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.143
EPSS Ranking 94.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2033
- https://twitter.com/taviso/status/1261079774190919680
- https://www.vandyke.com/products/securecrt/history.txt
- https://www.vandyke.com/support/advisory/index.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2033
- https://twitter.com/taviso/status/1261079774190919680
- https://www.vandyke.com/products/securecrt/history.txt
- https://www.vandyke.com/support/advisory/index.html
Products affected by CVE-2020-12651
-
cpe:2.3:a:vandyke:securecrt:*
-
cpe:2.3:a:vandyke:securecrt:2.4
-
cpe:2.3:a:vandyke:securecrt:4.1
-
cpe:2.3:a:vandyke:securecrt:5.5
-
cpe:2.3:a:vandyke:securecrt:6.2.0
-
cpe:2.3:a:vandyke:securecrt:6.5.2
-
cpe:2.3:a:vandyke:securecrt:6.5.3
-
cpe:2.3:a:vandyke:securecrt:6.6.2
-
cpe:2.3:a:vandyke:securecrt:6.7.2
-
cpe:2.3:a:vandyke:securecrt:8.5.4
-
cpe:2.3:a:vandyke:securecrt:8.7
-
cpe:2.3:a:vandyke:securecrt:8.7.1
-
cpe:2.3:o:apple:iphone_os:-
-
cpe:2.3:o:apple:macos:-
-
cpe:2.3:o:linux:linux_kernel:-
-
cpe:2.3:o:microsoft:windows:-