CVE-2020-24051 - CVE House
Back to Database
Status published Critical CVE-2020-24051

The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the...

Vulnerability Description

The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issue to execute privileged operations without authentication, for instance, to create a new Administrator user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24051

Credits & Attribution

No credits recorded in the NVD database.

References

More from moog

View All →
CVE-2020-24054
The administration console of the Moog EXO Series EXVF5C-2 and...
Critical 9.8
CVE-2020-24053
Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded...
High 7.5
CVE-2020-24052
Several XML External Entity (XXE) vulnerabilities in the Moog EXO...
Critical 9.1

Affected Vendor

Affected Software

exvf5c-2 firmware, exvp7c2-3 firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: August 21st, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.