CVE Feed

    Dashboard / CVE / CVE-2020-6994

    CVE-2020-6994

    A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.

    Published:Apr 3, 2020
    Last Modified:Nov 21, 2024
    EPS:Apr 3, 2020
    EPSS Score:0.00052
    CVSS Score:9.8

    Affected Products

    Vendor
    Belden
    Product
    Hirschmann Eagle20
    Vendor
    Belden
    Product
    Hirschmann Eagle30
    Vendor
    Belden
    Product
    Hirschmann Embedded Ethernet Switch
    Vendor
    Belden
    Product
    Hirschmann Embedded Ethernet Switch Extended
    Vendor
    Belden
    Product
    Hirschmann Greyhound Swtich
    Vendor
    Belden
    Product
    Hirschmann Hios
    Vendor
    Belden
    Product
    Hirschmann Hisecos
    Vendor
    Belden
    Product
    Hirschmann Mice Switch Power
    Vendor
    Belden
    Product
    Hirschmann Octopus
    Vendor
    Belden
    Product
    Hirschmann Prp Redbox
    Vendor
    Belden
    Product
    Hirschmann Rail Switch Power
    Vendor
    Belden
    Product
    Hirschmann Rail Switch Power Enhanced
    Vendor
    Belden
    Product
    Hirschmann Rail Switch Power Lite
    Vendor
    Belden
    Product
    Hirschmann Rail Switch Power Smart

    Exploits

    No exploit reference

    Related CVEs

    CVE-2019-12262 (CVSS 9.8) — Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET s…
    CVE-2019-12261 (CVSS 9.8) — Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is a…
    CVE-2019-12260 (CVSS 9.8) — Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET sec…
    CVE-2019-12258 (CVSS 7.5) — Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnera…
    CVE-2019-12255 (CVSS 9.8) — Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnera…
    CVE-2019-12265 (CVSS 5.3) — Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There…
    CVE-2019-12263 (CVSS 8.1) — Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET …
    CVE-2019-12259 (CVSS 7.5) — Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There i…
    CVE-2019-12256 (CVSS 9.8) — Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnera…
    CVE-2019-12257 (CVSS 8.8) — Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET secur…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High