CVE-2020-3920

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39217.5UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a speci CVE-2020-39229.8LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.CVE-2020-39239.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crac CVE-2020-39249.8DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific CVE-2020-39258.8A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is CVE-2020-39267.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39277.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.CVE-2020-39295.9GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack w CVE-2020-39303.3GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.CVE-2020-39319.8Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.