File parsing Type Confusion Remote code execution vulerability
CVE-2020-6656

5.8MEDIUM

Key Information:

Vendor

Eaton

Status
Easysoft Software
Vendor
CVE Published:
7 January 2021

What is CVE-2020-6656?

Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

easySoft Software v7.xx prior to v7.22

References

https://www.eaton.com/content/dam/eaton/company/news-insi...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-20-1441/
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-20-1442/
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eaton would like to thank Francis Provencher from ZDI
JSON
.