// For flags

CVE-2020-9048

victor Web Client - Arbitrary File Deletion Vulnerability

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

Una vulnerabilidad en versiones específicas de American Dynamics victor Web Client y Software House CCURE Web Client podría permitir a un atacante remoto no autenticado en la red eliminar archivos arbitrarios en el sistema o inutilizar el sistema realizando un ataque de Denegación de Servicio

*Credits: Joachim Kerschbaumer reported this vulnerability to Johnson Controls, Inc.
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-02-18 CVE Reserved
  • 2020-10-08 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-285: Improper Authorization
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Johnsoncontrols
Search vendor "Johnsoncontrols"
 Victor Web Client
Search vendor "Johnsoncontrols" for product "Victor Web Client"
 <= 5.4.1
Search vendor "Johnsoncontrols" for product "Victor Web Client" and version " <= 5.4.1"
-
Affected
Tyco
Search vendor "Tyco"
 C-cure Web Client
Search vendor "Tyco" for product "C-cure Web Client"
 <= 2.80
Search vendor "Tyco" for product "C-cure Web Client" and version " <= 2.80"
-
Affected