Vulnerability in Gurux Device Language Message Specification Director

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.

EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2020-8809?
CVE-2020-8809 is a high-severity vulnerability in Gurux Device Language Message Specification Director, classified under Download of Code Without Integrity Check. CVSS score: 8.1/10. Published 2020-02-25.
How severe is CVE-2020-8809?
High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2020-8809 known to be exploited?
6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.