CVE-2020-25195 Denial of service in Host Engineering H0-ECOM100 Module
An attacker can crash Host Engineering ECOM100 modules by bypassing client-side input validation on the configuration web server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25195?
CVE-2020-25195 is a high-severity denial of service vulnerability in Host Engineering H0-ECOM100 Module, published on 15 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device.
Weakness: CWE-20
Which versions are affected by CVE-2020-25195?
It affects 3 products.
Products include Hosteng H0-Ecom100 Firmware, Hosteng H2-Ecom100 Firmware, Hosteng H4-Ecom100 Firmware.
How do I fix CVE-2020-25195?
No fix has been published for CVE-2020-25195 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-25195 being exploited?
There is no known exploitation of CVE-2020-25195 in the wild and no public exploit code.
Other vulnerabilities in Host Engineering H0-ECOM100 Module
Sources
Also known as GHSA-wj48-f7rr-8fm2.