Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-7480

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.

Published

2020-03-23T20:15:12.543

Last Modified

2024-11-21T05:37:13.777

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-94
  • Type: Primary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System schneider-electric andover_continuum_9680_firmware * Yes
Hardware schneider-electric andover_continuum_9680 - No
Operating System schneider-electric andover_continuum_5740_firmware * Yes
Hardware schneider-electric andover_continuum_5740 - No
Operating System schneider-electric andover_continuum_5720_firmware * Yes
Hardware schneider-electric andover_continuum_5720 - No
Operating System schneider-electric andover_continuum_bcx4040_firmware * Yes
Hardware schneider-electric andover_continuum_bcx4040 - No
Operating System schneider-electric andover_continuum_bcx9640_firmware * Yes
Hardware schneider-electric andover_continuum_bcx9640 - No
Operating System schneider-electric andover_continuum_9900_firmware * Yes
Hardware schneider-electric andover_continuum_9900 - No
Operating System schneider-electric andover_continuum_9940_firmware * Yes
Hardware schneider-electric andover_continuum_9940 - No
Operating System schneider-electric andover_continuum_9941_firmware * Yes
Hardware schneider-electric andover_continuum_9941 - No
Operating System schneider-electric andover_continuum_9924_firmware * Yes
Hardware schneider-electric andover_continuum_9924 - No
Operating System schneider-electric andover_continuum_9702_firmware * Yes
Hardware schneider-electric andover_continuum_9702 - No
Operating System schneider-electric andover_continuum_9200_firmware * Yes
Hardware schneider-electric andover_continuum_9200 - No
References