CVE-2020-10636: ICSA-20-140-02 Emerson OpenEnterprise
First published: Thu Feb 24 2022(Updated: )
Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson OpenEnterprise SCADA Server | <=3.3.4 | |
| Emerson OpenEnterprise: all versions through 3.3.4 |
Remedy
Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 5 (3.3.5), to resolve these issues. OpenEnterprise Service Packs are available to users with access to the Emerson SupportNet system (login required). Details will be found in the downloads area. Please send any questions via a SupportNet ticket or by contacting Emerson at US 800-537-9313. For users outside of the United States, please use international toll-free numbers.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-10636?
CVE-2020-10636 is a vulnerability that allows the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.
How severe is CVE-2020-10636?
CVE-2020-10636 has a severity score of 7.5, which is considered high.
Which software versions are affected by CVE-2020-10636?
Emerson OpenEnterprise SCADA Server versions up to 3.3.4 are affected by CVE-2020-10636.
How can I fix the vulnerability in Emerson OpenEnterprise?
To fix the vulnerability in Emerson OpenEnterprise, you should apply the necessary security updates or patches provided by Emerson.
Where can I find more information about CVE-2020-10636?
You can find more information about CVE-2020-10636 on the CISA (Cybersecurity and Infrastructure Security Agency) website.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/severity
- agent/references
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/emerson
- canonical/emerson openenterprise scada server
- version/emerson openenterprise scada server/3.3.4
- canonical/emerson openenterprise: all versions through 3.3.4