CVE-2020-8974 CRITICAL

CVE-2020-8974: ZGR TPS200 NG Missing Reference to Active Allocated Resource

Vendor Zgr

Product ZGR TPS200 NG

Weakness CWE-434 · Unrestricted file upload

Published October 17, 2022

Last update May 13, 2025

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

What the vulnerability does

01Description

In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.

Key dates

02Disclosure timeline

October 17, 2022 CVE published

May 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-8974 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

Identifiers

CVE CVE-2020-8974

CWE CWE-434

CVSS 10.0 / CRITICAL

Affected versions

Vendor Zgr

Product ZGR TPS200 NG

Affected 2.00 firmware version 2.00

Vendor Zgr

Product ZGR TPS200 NG

Affected 1.01 hardware version 1.01

CVE-2020-8974: ZGR TPS200 NG Missing Reference to Active Allocated Resource

01Description

02Disclosure timeline

03References

04Related CVE