Input Validation Vulnerability in Sprecher SPRECON-E Firmware
CVE-2020-11496

6.7MEDIUM

Key Information:

Vendor

Sprecher-automation

Status
Sprecon-e
Vendor
CVE Published:
19 October 2020

What is CVE-2020-11496?

The Sprecher SPRECON-E firmware, specifically versions prior to 8.64b, is susceptible to an input validation vulnerability that can be exploited by local attackers. These attackers, leveraging unauthorized access to engineering data, may insert arbitrary code leading to potential system compromise. The firmware fails to adequately validate input values as required, exposing the system to risks when parameters are set via local configuration files. By crafting malicious commands and transferring them after compiling them into valid parameter files (PDLs), the attackers can execute these commands upon device restart, highlighting the critical need for improved validation mechanisms.

References

https://www.sprecher-automation.com/en/it-security/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.