CVE:CVE-2020-8963
CNNVD:CNNVD-202002-748
TimeTools是TimeTools开源的一款时间管理应用程序。
多款TimeTools产品中存在操作系统命令注入漏洞。攻击者可借助带有shell元字符的srmodel或srtime参数利用该漏洞执行任意操作系统命令。以下产品及版本受到影响：TimeTools SC7105 1.0.007版本；SC9205 1.0.007版本；SC9705 1.0.007版本；SR7110 1.0.007版本；SR9210 1.0.007版本；SR9750 1.0.007版本；SR9850 1.0.007版本；T100 1.0.003版本；T300 1.0.003版本；T550 1.0.003版本。
solution:Upgrade timetoolsltd sr9850_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sr9750_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sc9705_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sr9210_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sc9205_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sr7110_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd sc7105_firmware to a higher version than 1.0.007,and avoid the version 1.0.007; Upgrade timetoolsltd t100_firmware to a higher version than 1.0.003,and avoid the version 1.0.003; Upgrade timetoolsltd t300_firmware to a higher version than 1.0.003,and avoid the version 1.0.003; Upgrade timetoolsltd t550_firmware to a higher version than 1.0.003,and avoid the version 1.0.003