CVE-2020-13535
HIGHCVSS 7.8/10EPSS 0.66%
Last modified
CVE-2020-13535 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges.. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kepware | Linkmaster | 3.0.94.0 |
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1147Exploit, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1147Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-13535?
A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges.
How severe is CVE-2020-13535?
CVE-2020-13535 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.66% probability of exploitation in the next 30 days.
How do I fix CVE-2020-13535?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-1353An elevation of privilege vulnerability exists when the Wind…7.8
- CVE-2020-13530A denial-of-service vulnerability exists in the Ethernet/IP …7.5
- CVE-2020-13531A use-after-free vulnerability exists in a way Pixar OpenUSD…8.8
- CVE-2020-13532A privilege escalation vulnerability exists in Dream Report …7.8
- CVE-2020-13533A privilege escalation vulnerability exists in Dream Report …7.8
- CVE-2020-13534A privilege escalation vulnerability exists in Dream Report …7.8
- CVE-2020-13536An exploitable local privilege elevation vulnerability exist…7.8
- CVE-2020-13537An exploitable local privilege elevation vulnerability exist…7.8
- CVE-2020-13539An exploitable local privilege elevation vulnerability exist…7.8
- CVE-2020-1354An elevation of privilege vulnerability exists when the Wind…7.8
- CVE-2020-13540An exploitable local privilege elevation vulnerability exist…7.8
- CVE-2020-13541An exploitable local privilege elevation vulnerability exist…8.8
Are you affected by CVE-2020-13535?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST