victor Web Client - Arbitrary File Deletion Vulnerability
CVE-2020-9048

7.1HIGH

Key Information:

Vendor: Johnson Controls
Status: Victor Web Client Version 5.4.1 And Prior
Vendor: CVE Published:; 8 October 2020

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2020-9048?

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

Affected Version(s)

victor Web Client version 5.4.1 and prior <= 5.4.1

References

https://www.johnsoncontrols.com/cyber-solutions/security-...

x_refsource_CONFIRM

https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01

third-party-advisoryx_refsource_CERT

CVSS V3.1

Score:

7.1

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2020
Vulnerability Reserved
Feb 18, 2020

Credit

Joachim Kerschbaumer reported this vulnerability to Johnson Controls, Inc.

CVE-2020-9048 Data

JSON