spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15809
Reference (s):
- https://support.spinetix.com/wiki/DSOS_release_notes
- https://support.spinetix.com/wiki/SpinetiX-SA-20:01