« Volver al listado

CVE-2020-27259

Estado: ModificadaAlta (8.8)—

The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Omron — Cx-oneOmron — Cx-positionOmron — Cx-protocolOmron — Cx-server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-27259",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Omron",
          "product": "CX-One",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "4.60"
            }
          ]
        },
        {
          "vendor": "Omron",
          "product": "CX-Protocol",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.02"
            }
          ]
        },
        {
          "vendor": "Omron",
          "product": "CX-Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "5.0.28"
            }
          ]
        },
        {
          "vendor": "Omron",
          "product": "CX-Position",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.52"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-09T15:15:13.097",
  "references": [
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-182/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-007-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-182/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-822"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Omron CX-One versiones 4.60 y anteriores, puede permitir a un atacante suministrar un puntero a ubicaciones de memoria arbitrarias, lo que puede permitir a un atacante ejecutar código arbitrario remotamente"
    }
  ],
  "lastModified": "2026-06-17T03:09:04.300",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:omron:cx-one:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DDFA8C8-5BB3-4A0A-BFA8-0963C46B6DD2",
              "versionEndIncluding": "4.60"
            },
            {
              "criteria": "cpe:2.3:a:omron:cx-position:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A75973B-C2B1-4CFC-A2A9-BFB553037BF2",
              "versionEndIncluding": "2.52"
            },
            {
              "criteria": "cpe:2.3:a:omron:cx-protocol:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E61B773-2097-4C4E-B48C-CFC7294A4C5A",
              "versionEndIncluding": "2.02"
            },
            {
              "criteria": "cpe:2.3:a:omron:cx-server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DD31345-F164-4016-902E-DA9AD29430E4",
              "versionEndIncluding": "5.0.28"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}