CVE-2020-10632: ICSA-20-140-02 Emerson OpenEnterprise
First published: Thu Feb 24 2022(Updated: )
Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson OpenEnterprise SCADA Server | <=3.3.4 | |
| Emerson OpenEnterprise: all versions through 3.3.4 |
Remedy
Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 5 (3.3.5), to resolve these issues. OpenEnterprise Service Packs are available to users with access to the Emerson SupportNet system (login required). Details will be found in the downloads area. Please send any questions via a SupportNet ticket or by contacting Emerson at US 800-537-9313. For users outside of the United States, please use international toll-free numbers.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2020-10632.
What is the severity of CVE-2020-10632?
The severity of CVE-2020-10632 is high with a CVSS score of 5.3.
Which software versions are affected by CVE-2020-10632?
Emerson OpenEnterprise SCADA Server versions up to and including 3.3.4 are affected by CVE-2020-10632.
What is the impact of CVE-2020-10632?
CVE-2020-10632 can allow modification of important configuration files, leading to system failure or unpredictable behavior.
Is there a fix available for CVE-2020-10632?
At the moment, there is no known fix or patch available for CVE-2020-10632. It is recommended to follow the recommendations provided by the vendor and avoid exposing the affected system to untrusted networks.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/severity
- agent/references
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/emerson
- canonical/emerson openenterprise scada server
- version/emerson openenterprise scada server/3.3.4
- canonical/emerson openenterprise: all versions through 3.3.4