CVE-2020-10640: ICSA-20-140-02 Emerson OpenEnterprise
First published: Thu Feb 24 2022(Updated: )
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson OpenEnterprise SCADA Server | <=3.3.4 | |
| Emerson OpenEnterprise: all versions through 3.3.4 |
Remedy
Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 5 (3.3.5), to resolve these issues. OpenEnterprise Service Packs are available to users with access to the Emerson SupportNet system (login required). Details will be found in the downloads area. Please send any questions via a SupportNet ticket or by contacting Emerson at US 800-537-9313. For users outside of the United States, please use international toll-free numbers.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for Emerson OpenEnterprise?
The vulnerability ID for Emerson OpenEnterprise is CVE-2020-10640.
What is the severity level of CVE-2020-10640?
The severity level of CVE-2020-10640 is critical.
What software versions are affected by CVE-2020-10640?
Emerson OpenEnterprise versions up to and including 3.3.4 are affected by CVE-2020-10640.
What can an attacker do with CVE-2020-10640?
An attacker can run arbitrary commands with system privileges or perform remote code execution using CVE-2020-10640.
Is there a fix available for CVE-2020-10640?
It is recommended to update Emerson OpenEnterprise to version 3.3.5 or later to mitigate CVE-2020-10640.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/title
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/severity
- agent/references
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/emerson
- canonical/emerson openenterprise scada server
- version/emerson openenterprise scada server/3.3.4
- canonical/emerson openenterprise: all versions through 3.3.4