CVE-2020-6656: File parsing Type Confusion Remote code execution vulerability
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2020-6656.
What is the severity of CVE-2020-6656?
CVE-2020-6656 has a severity score of 7.8 (high).
Which software versions are affected by CVE-2020-6656?
Versions of Eaton's easySoft software prior to v7.22 (7.00 to 7.20) are affected by CVE-2020-6656.
What is the impact of CVE-2020-6656?
The vulnerability allows a malicious entity to execute a malicious code or crash the application by tricking the user into uploading a malformed .E70 file.
Where can I find more information about CVE-2020-6656?
You can find more information about CVE-2020-6656 in the following references: [Link 1](https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03), [Link 2](https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf), [Link 3](https://www.zerodayinitiative.com/advisories/ZDI-20-1441/).