What’s Vulnerable › Vulnerabilities

CVE-2020-15809

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-24 · updated 2026-06-17
• Weakness: CWE-22

Description

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.

Affected products

• Spinetix Diva Firmware: through 4.5.2-1.0.36229
• Spinetix Dsos: through 4.5.2-1.0.2-1eb2ffbd
• Spinetix Hmp300 Firmware: through 4.5.2-1.0.36229
• Spinetix Hmp350 Firmware: through 4.5.2-1.0.36229
• Spinetix Hmp400 Firmware: through 4.5.2-1.0.2-1eb2ffbd
• Spinetix Hmp400W Firmware: through 4.5.2-1.0.2-1eb2ffbd

References

• https://support.spinetix.com/wiki/DSOS_release_notes
• https://support.spinetix.com/wiki/SpinetiX-SA-20:01
• https://support.spinetix.com/wiki/DSOS_release_notes
• https://support.spinetix.com/wiki/SpinetiX-SA-20:01

Get alerted when CVE-2020-15809 or the next vulnerability affects your stack