What is the CVSS score of CVE-2020-7480?

CVE-2020-7480 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Andover Continuum 9680 Firmware CVE-2020-7480

CRITICAL

Code Injection (CWE-94)

2020-03-23 cybersecurity@se.com

RCE Code Injection Andover Continuum 9680 Firmware Andover Continuum 5740 Firmware Andover Continuum 5720 Firmware Andover Continuum Bcx4040 Firmware Andover Continuum Bcx9640 Firmware Andover Continuum 9900 Firmware Andover Continuum 9940 Firmware Andover Continuum 9941 Firmware Andover Continuum 9924 Firmware Andover Continuum 9702 Firmware Andover Continuum 9200 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 23, 2020 - 20:15 nvd

CRITICAL 9.8

DescriptionNVD

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.

AnalysisAI

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data. Affected products include: Schneider-Electric Andover Continuum 9680 Firmware, Schneider-Electric Andover Continuum 5740 Firmware, Schneider-Electric Andover Continuum 5720 Firmware, Schneider-Electric Andover Continuum Bcx4040 Firmware, Schneider-Electric Andover Continuum Bcx9640 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.