CVE-2020-6655: File parsing Out-Of-Bounds read remote code execution
First published: Thu Jan 07 2021(Updated: )
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.
Credit: CybersecurityCOE@eaton.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eaton EASYsoft | >=7.00<7.22 | |
| Eaton Versions 7.20 and prior of EASYsoft are affected |
Remedy
Apply the patch once it is provided by Eaton.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-20-1443/
- https://www.cisa.gov/news-events/ics-advisories/icsa-21-007-03 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for the Eaton's easySoft software vulnerability?
The vulnerability ID is CVE-2020-6655.
What is the severity rating for CVE-2020-6655?
The severity rating for CVE-2020-6655 is 7.8 (high).
What is the affected software for CVE-2020-6655?
The affected software for CVE-2020-6655 is the Eaton's easySoft software v7.xx prior to v7.22.
How can a malicious entity exploit CVE-2020-6655?
A malicious entity can exploit CVE-2020-6655 by executing a malicious code or crashing the application by tricking the user to upload a malformed .E70 file.
Where can I find more information about CVE-2020-6655?
You can find more information about CVE-2020-6655 at the following references: [Reference 1](https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03), [Reference 2](https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf), [Reference 3](https://www.zerodayinitiative.com/advisories/ZDI-20-1443/).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/eaton
- canonical/eaton easysoft
- version/eaton easysoft/7.00
- canonical/eaton versions 7.20 and prior of easysoft are affected