CVE-2020-12106

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administrative functions such as, changing credentials of the Administrator account or connect the product to a rogue access point.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-121079.8The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this moduleCVE-2020-121086.5/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-121098.8Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, CVE-2020-12117.8An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'ConnecCVE-2020-121109.8Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 2CVE-2020-121118.8Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.CVE-2020-121127.5BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.CVE-2020-121136.1BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.CVE-2020-121144.7A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.xCVE-2020-121167.5Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitraryCVE-2020-121175.3Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted paCVE-2020-121188.2The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to com
CVE-2020-12106: Critical severity, CVSS 9.8 | Vulnix