CVE-2020-14505

moderate-risk
Published 2020-07-15

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any validation. The attacker may then remotely execute code.

Do I need to act?

~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Advantech

References (4)

Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-831/
Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-831/
43
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 6/34 · Minimal
Exposure 5/34 · Minimal