CVEvulnerability

CVE-2020-8964

9.8 CRITICAL Published 2020-02-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-798

Description

TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie."

Affected configurations

• timetoolsltd sr9850 firmware 1.0.007 • timetoolsltd sr9750 firmware 1.0.007 • timetoolsltd sc9705 firmware 1.0.007 • timetoolsltd sr9210 firmware 1.0.007 • timetoolsltd sc9205 firmware 1.0.007 • timetoolsltd sr7110 firmware 1.0.007 • timetoolsltd sc7105 firmware 1.0.007 • timetoolsltd t100 firmware 1.0.003 • timetoolsltd t300 firmware 1.0.003 • timetoolsltd t550 firmware 1.0.003

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References