Read the docs
TI-2020-14219 Aliases CVE-2020-21994GHSA-j6wp-x7wc-m898

AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that…

Priority MEDIUM 48CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful authentication bypass attack.

Why it matters now

EPSS 0.0366 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:ave:dominaplus:*:*:*:*:*:*:*:*1.10.11 – 1.10.77VulnerableAve
cpe:2.3:o:ave:53ab-wbs_firmware:1.10.62:*:*:*:*:*:*:*1.10.62VulnerableAve
cpe:2.3:h:ave:53ab-wbs:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
cpe:2.3:o:ave:ts01_firmware:1.0.65:*:*:*:*:*:*:*1.0.65VulnerableAve
cpe:2.3:h:ave:ts01:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
cpe:2.3:o:ave:ts03x-v_firmware:1.10.45a:*:*:*:*:*:*:*1.10.45aVulnerableAve
cpe:2.3:h:ave:ts03x-v:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
cpe:2.3:o:ave:ts04x-v_firmware:1.10.45a:*:*:*:*:*:*:*1.10.45aVulnerableAve
cpe:2.3:h:ave:ts04x-v:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
cpe:2.3:o:ave:ts05_firmware:1.10.36:*:*:*:*:*:*:*1.10.36VulnerableAve
  • cpe:2.3:a:ave:dominaplus:*:*:*:*:*:*:*:* Versions 1.10.11 – 1.10.77 Vulnerable ·Ave
  • cpe:2.3:o:ave:53ab-wbs_firmware:1.10.62:*:*:*:*:*:*:* Versions 1.10.62 Vulnerable ·Ave
  • cpe:2.3:h:ave:53ab-wbs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave
  • cpe:2.3:o:ave:ts01_firmware:1.0.65:*:*:*:*:*:*:* Versions 1.0.65 Vulnerable ·Ave
  • cpe:2.3:h:ave:ts01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave
  • cpe:2.3:o:ave:ts03x-v_firmware:1.10.45a:*:*:*:*:*:*:* Versions 1.10.45a Vulnerable ·Ave
  • cpe:2.3:h:ave:ts03x-v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave
  • cpe:2.3:o:ave:ts04x-v_firmware:1.10.45a:*:*:*:*:*:*:* Versions 1.10.45a Vulnerable ·Ave
  • cpe:2.3:h:ave:ts04x-v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave
  • cpe:2.3:o:ave:ts05_firmware:1.10.36:*:*:*:*:*:*:* Versions 1.10.36 Vulnerable ·Ave
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:ave:ts05:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
cpe:2.3:o:ave:ts05n-v_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableAve
cpe:2.3:h:ave:ts05n-v:-:*:*:*:*:*:*:*not specified by NVDRunning onAve
  • cpe:2.3:h:ave:ts05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave
  • cpe:2.3:o:ave:ts05n-v_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ave
  • cpe:2.3:h:ave:ts05n-v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Ave

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-21994
  2. 2026-10-03 Alias added: GHSA-j6wp-x7wc-m898

References

Exploit 2

Other 1

  • TI-2020-14216 AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to… CVSS 3.1CRITICAL 9.8
  • TI-2020-14221 AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences