CVE-2020-14505
CRITICALAdvantech iView < 5.6 - Remote Code Execution via HTTP Request Command Injection
Title source: llmDescription
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any validation. The attacker may then remotely execute code.
References (2)
Core 2
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01
Third Party Advisory x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-20-831/
Scores
CVSS v3
9.8
EPSS
0.0300
EPSS Percentile
86.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-74
CWE-77
Status
published
Products (1)
advantech/iview
< 5.6
Published
Jul 15, 2020
Tracked Since
Feb 18, 2026