CVE-2020-8974 ZGR TPS200 NG Missing Reference to Active Allocated Resource

Critical 10.0 Published 17 Oct 2022 Updated 13 May 2025

An attacker can upload malicious firmware to the ZGR TPS200 NG device via the web interface, rendering the device unusable.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-8974?

CVE-2020-8974 is a critical vulnerability in ZGR TPS200 NG, published on 17 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.

Weakness: CWE-434

Which versions are affected by CVE-2020-8974?

It affects 1 product.

Products include Zigor Zgr Tps200 Ng Firmware.

How do I fix CVE-2020-8974?

No fix has been published for CVE-2020-8974 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-8974 being exploited?

There is no known exploitation of CVE-2020-8974 in the wild and no public exploit code.

Sources

Also known as GHSA-hrxj-958h-7348.