CVE-2020-13599

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6q

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-13607.8An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka 'Windows Profile Ser CVE-2020-136007.6Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-CVE-2020-136019.8Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see CVE-2020-136025.5Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with CVE-2020-136037.8Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For m CVE-2020-13615.5An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker wo CVE-2020-136145.9An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.CVE-2020-136155.9lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.CVE-2020-136165.9The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.CVE-2020-136177.5The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker CVE-2020-136199.8php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.CVE-2020-13627.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi