CVE-2020-6656: falha de média gravidade em Eaton easySoft Software
File parsing Type Confusion Remote code execution vulerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 2.8%
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Produtos afetados
Eaton · easySoft SoftwareCVEs relacionadas — Eaton easySoft Software
No mesmo produto, das mais perigosas para as menos.
Referências
https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdfhttps://www.zerodayinitiative.com/advisories/ZDI-20-1441/https://www.zerodayinitiative.com/advisories/ZDI-20-1442/https://www.zerodayinitiative.com/advisories/ZDI-20-1444/