CVE-2020-6970

CRITICAL

Emerson Openenterprise Scada Server < 3.3.3 - Out-of-Bounds Write

Title source: rule
STIX 2.1

Description

A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of OpenEnterprise 3.1 through 3.3.3, where a specially crafted script could execute code on the OpenEnterprise Server.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-049-02

Scores

CVSS v3 9.8
EPSS 0.0115
EPSS Percentile 78.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-122 CWE-787
Status published
Products (2)
emerson/openenterprise_scada_server 2.8.3
emerson/openenterprise_scada_server 3.1 - 3.3.3
Published Feb 19, 2020
Tracked Since Feb 18, 2026