Path Traversal in Thalesgroup Bgs5

CVE-2020-15858

Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L.

EPSS exploit prediction

EPSS: 0.008 (54.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2020-15858: held from 0.008 to 0.008.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2020-15858?
CVE-2020-15858 is a medium-severity vulnerability in Thalesgroup Bgs5, classified under Path Traversal. CVSS score: 6.2/10. Published 2020-08-21.
How severe is CVE-2020-15858?
Medium severity. CVSS v3 base score is 6.2 out of 10.