CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2020-29031
High (8.1) in secomea. EPSS 0.7% chance of exploitation in the next 30 days.
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-280
- Published
- Modified
- Record from
- the NVD, synced
Affected
- secomea:gatemanager_4250_firmware
- secomea:gatemanager_4260_firmware
- secomea:gatemanager_8250_firmware
- secomea:gatemanager_9250_firmware