CVE-2020-7480
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.54% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- schneider-electric/andover continuum 9680 firmware · schneider-electric/andover continuum 5740 firmware · schneider-electric/andover continuum 5720 firmware · schneider-electric/andover continuum bcx4040 firmware · schneider-electric/andover continuum bcx9640 firmware · schneider-electric/andover continuum 9900 firmware · schneider-electric/andover continuum 9940 firmware · schneider-electric/andover continuum 9941 firmware · schneider-electric/andover continuum 9924 firmware · schneider-electric/andover continuum 9702 firmware · schneider-electric/andover continuum 9200 firmware
- Source
- cybersecurity@se.com
References
- https://www.se.com/ww/en/download/document/SEVD-2020-070-04/Vendor Advisory
- https://www.se.com/ww/en/download/document/SEVD-2020-070-04/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.