Cyber Resilience

CVE-2020-15809

Medium

Published: 24 March 2021

Published
24 March 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0022 45.2th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-15809 is a medium-severity Path Traversal (CWE-22) vulnerability in Spinetix Dsos. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

spinetix
dsos
≤ 4.5.2-1.0.2-1eb2ffbd
spinetix
hmp350 firmware
≤ 4.5.2-1.0.36229
spinetix
hmp300 firmware
≤ 4.5.2-1.0.36229
spinetix
diva firmware
≤ 4.5.2-1.0.36229
spinetix
hmp400 firmware
≤ 4.5.2-1.0.2-1eb2ffbd
spinetix
hmp400w firmware
≤ 4.5.2-1.0.2-1eb2ffbd

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22 CWE-918

Validates pathnames and filenames to prevent traversal outside intended directories.

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References