CVE-2020-10640: ICSA-20-140-02 Emerson OpenEnterprise
Published Feb 24, 2022
·Updated
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.
Affected Software
2 affected components
Emerson OpenEnterprise: all versions through 3.3.4
Emerson OpenEnterprise SCADA Server<=3.3.4
Remediation
Information
Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 5 (3.3.5), to resolve these issues. OpenEnterprise Service Packs are available to users with access to the Emerson SupportNet system (login required). Details will be found in the downloads area.
Please send any questions via a SupportNet ticket or by contacting Emerson at US 800-537-9313. For users outside of the United States, please use international toll-free numbers.
Event History
Feb 24, 2022
CVE Published
via MITRE·06:50 PM
Data Sourced
via MITRE·06:50 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for Emerson OpenEnterprise?
The vulnerability ID for Emerson OpenEnterprise is CVE-2020-10640.
2
What is the severity level of CVE-2020-10640?
The severity level of CVE-2020-10640 is critical.
3
What software versions are affected by CVE-2020-10640?
Emerson OpenEnterprise versions up to and including 3.3.4 are affected by CVE-2020-10640.
4
What can an attacker do with CVE-2020-10640?
An attacker can run arbitrary commands with system privileges or perform remote code execution using CVE-2020-10640.
5
Is there a fix available for CVE-2020-10640?
It is recommended to update Emerson OpenEnterprise to version 3.3.5 or later to mitigate CVE-2020-10640.