What’s Vulnerable › Vulnerabilities

CVE-2020-8964

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-13 · updated 2026-06-17
• Weakness: CWE-798

Description

TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie."

Affected products

• Timetoolsltd Sc7105 Firmware: 1.0.007
• Timetoolsltd Sc9205 Firmware: 1.0.007
• Timetoolsltd Sc9705 Firmware: 1.0.007
• Timetoolsltd Sr7110 Firmware: 1.0.007
• Timetoolsltd Sr9210 Firmware: 1.0.007
• Timetoolsltd Sr9750 Firmware: 1.0.007
• Timetoolsltd Sr9850 Firmware: 1.0.007
• Timetoolsltd T100 Firmware: 1.0.003
• Timetoolsltd T300 Firmware: 1.0.003
• Timetoolsltd T550 Firmware: 1.0.003

References

• https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html
• https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html

Get alerted when CVE-2020-8964 or the next vulnerability affects your stack