Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cvelistABBCVELIST:CVE-2020-24682
HistoryFeb 02, 2024 - 7:11 a.m.

CVE-2020-24682 Automation Studio and PVI Multiple unquoted service path vulnerabilities

2024-02-0207:11:44
CWE-428
ABB
www.cve.org
2
cve-2020-24682
automation studio
pvi
unquoted service path
b&r industrial automation
elevated privileges
net/pvi

CVSS3

7.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

0

Percentile

9.0%

JSON

Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Automation Studio",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "4.6",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.7.7 SP",
        "status": "affected",
        "version": "4.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.8.6 SP",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.9.4 SP",
        "status": "affected",
        "version": "4.9.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NET/PVI",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "4.6",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.7.7",
        "status": "affected",
        "version": "4.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.8.6",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.9.4",
        "status": "affected",
        "version": "4.9.0",
        "versionType": "custom"
      }
    ]
  }
]

Related

nvd 1
cve 1
prion 1
nvd
nvd
CVE-2020-24682
2024-02-02 08:15:45
cve
cve
CVE-2020-24682
2024-02-02 08:15:45
prion
prion
Path traversal
2024-02-02 08:15:00

CVSS3

7.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

0

Percentile

9.0%

JSON
Related for CVELIST:CVE-2020-24682
nvd1cve1prion1