CVE-2020-10055

Katalog CVE

CVSS 9.8 · Critical EPSS 6,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada siemens desigo consumption control, siemens desigo consumption control compact. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.

Rincian

Terbit di NVD

14 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

6,0% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf patch · advisory vendor
• https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 patch · advisory pihak ketiga · pemerintah AS