Vulnerability Details : CVE-2020-9048
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
Vulnerability category: BypassGain privilegeDenial of service
Products affected by CVE-2020-9048
- cpe:2.3:a:johnsoncontrols:victor_web_client:*:*:*:*:*:*:*:*
- cpe:2.3:a:tyco:c-cure_web_client:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-9048
0.98%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-9048
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:A/AC:L/Au:N/C:N/I:C/A:C |
6.5
|
9.2
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
2.8
|
5.2
|
NIST | |
|
7.1
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
2.8
|
4.2
|
Johnson Controls |
CWE ids for CVE-2020-9048
-
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.Assigned by: productsecurity@jci.com (Secondary)
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-9048
-
https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01
Johnson Controls Sensormatic Electronics American Dynamics victor Web Client | CISAMitigation;Third Party Advisory;US Government Resource
-
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
Product Security AdvisoriesPatch;Third Party Advisory
Jump to