CVE-2020-9034

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sku11army.blogspot.com/2020/01/symmetricom-syncserver_27.htmlExploit, Third Party Advisory
https://sku11army.blogspot.com/2020/01/symmetricom-syncserver_27.htmlExploit, Third Party Advisory

Timeline

Published: Feb 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-90366.1Jeedom through 4.0.38 allows XSS.CVE-2020-90385.4Joplin through 1.0.184 allows Arbitrary File Read via XSS.CVE-2020-90399.8Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the pro CVE-2020-90407.5Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker CVE-2020-90417.5In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are CVE-2020-90428.8In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to CVE-2020-90438.8The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.CVE-2020-90449.1XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of AS CVE-2020-90456.5During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credential CVE-2020-90467.8A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-CVE-2020-90477.2A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web S CVE-2020-90488.1A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauth