CVE-2020-16245
Advantech iView NetworkServlet findSummaryCfgDeviceListExport Directory Traversal Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
Advantech iView, versiones 5.7 y anteriores. El producto afectado es susceptible a vulnerabilidades de salto de ruta que podrían permitir a un atacante crear y descargar archivos arbitrarios, limitar la disponibilidad del sistema y ejecutar código remotamente
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processing of calls to the findSummaryCfgDeviceListExport method of the NetworkServlet class. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-07-31 CVE Reserved
- 2020-08-25 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-20-238-01 | Third Party Advisory | |
| https://www.zerodayinitiative.com/advisories/ZDI-20-1084 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1085 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1086 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1087 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1088 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1089 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1090 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1091 | Third Party Advisory |
|
| https://www.zerodayinitiative.com/advisories/ZDI-20-1092 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|