CVEvulnerability

CVE-2020-25195

7.5 HIGH Published 2020-12-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-12-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-20

Description

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device.

Affected configurations

• hosteng h0-ecom100 firmware (<= 4.0.348) • hosteng h0-ecom100 firmware (<= 4.1.113) • hosteng h0-ecom100 firmware (<= 5.0.149) • hosteng h2-ecom100 firmware (<= 4.0.2148) • hosteng h2-ecom100 firmware (<= 5.0.1043) • hosteng h4-ecom100 firmware (<= 4.0.2148)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References