Reject Remote Management via Cellular UPLINK2
Priority MEDIUM 43CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured credentials. This issue affects: Secomea SiteManager All versions prior to 9.4.620527004 on Hardware.
Why it matters now
EPSS 0.01742 77th percentileScored 2026-11-07
Fix Fixed SiteManager (Secomea): 9.4.620527004
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Secomea | SiteManager | All to before 9.4.620527004 | 9.4.620527004 | Patch available | CNA |
- SiteManager VendorSecomea Affected All to before 9.4.620527004 Fixed in 9.4.620527004 Patch available CNA
Remediation
- Fix · CNA SiteManager (Secomea) Fixed in 9.4.620527004
Timeline
- 2026-10-02 Threatist record created from CVE-2020-29020
- 2026-10-03 Alias added: GHSA-9pq7-49qc-7557
References
More Secomea Sitemanager Firmware vulnerabilities
- TI-2021-11983 Configuration service port remains open 10 minutes after reboot even when already provisioned CVSS 3.1HIGH 8.0
- TI-2021-11982 SiteManager troubleshooter allows access without authentication from local network CVSS 3.1MEDIUM 4.3
Sources
- CVE-2020-29020 · CVE Program
- CVE-2020-29020 · NVD
- FIRST EPSS
- GHSA-9pq7-49qc-7557 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences