CVE-2020-24990

Name of the Vulnerable Software and Affected Versions QSC Q-SYS Core Manager version 8.2.1 QSC Q-SYS Core Manager versions prior to 8.2.1

Description An issue was discovered in QSC Q-SYS Core Manager. A remote attacker can perform a directory traversal via the TFTP service running on UDP port 69 and obtain operating system files by sending a TFTP GET request. For example, an attacker can read /etc/passwd or /proc/version files.

Recommendations For QSC Q-SYS Core Manager version 8.2.1, update to a version that fixes this issue. For QSC Q-SYS Core Manager versions prior to 8.2.1, update to a version that fixes this issue. As a temporary workaround, consider disabling the TFTP service running on UDP port 69 until a patch is available.