CVE-2020-6970

2020-02-1920:19:55

CWE-122

icscert

www.cve.org

9.7 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.3%

JSON

A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of OpenEnterprise 3.1 through 3.3.3, where a specially crafted script could execute code on the OpenEnterprise Server.

CNA Affected

[
  {
    "product": "OpenEnterprise SCADA Server",
    "vendor": "Emerson",
    "versions": [
      {
        "status": "affected",
        "version": "2.83 (if Modbus or ROC Interfaces have been installed and are in use)"
      }
    ]
  },
  {
    "product": "OpenEnterprise",
    "vendor": "Emerson",
    "versions": [
      {
        "status": "affected",
        "version": "3.1 through 3.3.3"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-20-049-02