Gogogate Ismartgate Pro Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Gogogate Ismartgate Pro Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2020-12839 — CVSS 9.8 (critical): ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.
• CVE-2020-12843 — CVSS 9.8 (critical): ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV…
• CVE-2020-12842 — CVSS 9.8 (critical): ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.
• CVE-2020-12838 — CVSS 9.8 (critical): ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.
• CVE-2020-12282 — CVSS 8.8 (high): iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php…
• CVE-2020-13119 — CVSS 8.1 (high): ismartgate PRO 1.5.9 is vulnerable to clickjacking.
• CVE-2020-12837 — CVSS 7.5 (high): ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must…
• CVE-2020-12840 — CVSS 6.5 (medium): ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php
• CVE-2020-12841 — CVSS 6.5 (medium): ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php
• CVE-2020-12281 — CVSS 6.5 (medium): iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
• CVE-2020-12280 — CVSS 6.5 (medium): iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.