« Volver al listado

CVE-2020-6970

Estado: ModificadaCrítica (9.8)—

A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of OpenEnterprise 3.1 through 3.3.3, where a specially crafted script could execute code on the OpenEnterprise Server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Emerson — Openenterprise Scada Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6970",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Emerson",
          "product": "OpenEnterprise SCADA Server",
          "versions": [
            {
              "status": "affected",
              "version": "2.83 (if Modbus or ROC Interfaces have been installed and are in use)"
            }
          ]
        },
        {
          "vendor": "Emerson",
          "product": "OpenEnterprise",
          "versions": [
            {
              "status": "affected",
              "version": "3.1 through 3.3.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-19T21:15:11.653",
  "references": [
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-049-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-049-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of OpenEnterprise 3.1 through 3.3.3, where a specially crafted script could execute code on the OpenEnterprise Server."
    },
    {
      "lang": "es",
      "value": "Se encontró un desbordamiento de búfer en la región heap de la memoria en Emerson OpenEnterprise SCADA Server versión 2.83 (si las Interfaces Modbus o ROC se han instalado y están en uso) y todas las versiones de OpenEnterprise 3.1 hasta 3.3.3, donde un script especialmente diseñado podría ejecutar código en el OpenEnterprise Server."
    }
  ],
  "lastModified": "2026-06-17T03:24:02.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emerson:openenterprise_scada_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "271688F8-AB9E-43BE-B46E-517F78D3D650",
              "versionEndIncluding": "3.3.3",
              "versionStartIncluding": "3.1"
            },
            {
              "criteria": "cpe:2.3:a:emerson:openenterprise_scada_server:2.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "652B19A1-64C4-4AD0-8833-BA076979B245"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}