CVE-2020-6656CWE-20CWE-843

File parsing Type Confusion Remote code execution vulerability

Medium · published January 7, 2021

CVSS v3.1
5.8
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02823 · 86.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2021-01-07T17:22Z
EPSS history
Timeline
  • 07 JAN 17:22Z
    File parsing Type Confusion Remote code execution vulerability
    cvelistv5