{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"names":["Martin Aman"],"organization":"ProtectEM","summary":"reported"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"An open port used for debugging grants root access to the device without access control via network.","title":"Summary"},{"category":"description","text":"A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices.","title":"Impact"},{"category":"description","text":"SWARCO TRAFFIC SYSTEMS released a patch to fix the vulnerability and close the port. Please contact your SWARCO TRAFFIC SYSTEMS contact person for further information.","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"security-meldungen@swarco.de","name":"SWARCO TRAFFIC SYSTEMS GmbH","namespace":"https://www.swarco.de"},"references":[{"category":"external","summary":"CERT@VDE Security Advisories for SWARCO","url":"https://certvde.com/en/advisories/vendor/swarco/"},{"category":"self","summary":"VDE-2020-016: SWARCO: Critical Vulnerability in CPU LS4000 - HTML","url":"https://certvde.com/de/advisories/VDE-2020-016/"},{"category":"self","summary":"VDE-2020-016: SWARCO: Critical Vulnerability in CPU LS4000 - CSAF","url":"https://swarco.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-016.json"}],"title":"SWARCO: Critical Vulnerability in CPU LS4000","tracking":{"aliases":["VDE-2020-016"],"current_release_date":"2020-05-28T13:00:00.000Z","generator":{"date":"2025-01-15T13:47:43.142Z","engine":{"name":"Secvisogram","version":"2.5.16"}},"id":"VDE-2020-016","initial_release_date":"2020-05-28T13:00:00.000Z","revision_history":[{"date":"2020-05-28T13:00:00.000Z","number":"1","summary":"Initial revision."}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"CPU LS4000","product":{"name":"SWARCO Hardware CPU LS4000","product_id":"CSAFPID-11002"}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_name","name":"G4*","product":{"name":"Firmware G4*","product_id":"CSAFPID-21001"}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"SWARCO"}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware G4* installed on SWARCO Hardware CPU LS4000","product_id":"CSAFPID-31003"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"}]},"vulnerabilities":[{"cve":"CVE-2020-12493","cwe":{"id":"CWE-284","name":"Improper Access Control"},"notes":[{"category":"description","text":"An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices.","title":"Vulnerability Description"}],"product_status":{"known_affected":["CSAFPID-31003"]},"remediations":[{"category":"vendor_fix","details":"SWARCO TRAFFIC SYSTEMS released a patch to fix the vulnerability and close the port. Please contact your SWARCO TRAFFIC SYSTEMS contact person for further information.","product_ids":["CSAFPID-31003"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":10,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":10,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31003"]}],"title":"CVE-2020-12493"}]}