CVE-2020-9048

HIGH

Johnsoncontrols Victor Web Client < 5.4.1 - Improper Authorization

Title source: rule

Description

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_confirm

https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Mitigation, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert

https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01

Scores

CVSS v3 7.1

EPSS 0.0098

EPSS Percentile 76.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Details

CWE

CWE-285 CWE-732

Status published

Products (2)

johnsoncontrols/victor_web_client < 5.4.1

tyco/c-cure_web_client < 2.80

Published Oct 08, 2020

Tracked Since Feb 18, 2026