CVE-2020-3936

CRITICAL

UltraLog Express Firmware - SQL Injection via Device Management Interface Parameters

Title source: llm

Description

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://www.twcert.org.tw/tw/cp-132-3451-7d9f0-1.html

Scores

CVSS v3 10.0

EPSS 0.0125

EPSS Percentile 66.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

unisoon/ultralog_express_firmware 1.4.0

Published Mar 27, 2020

Tracked Since Feb 18, 2026