CVE-2020-25191

Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboot the CompactRIO (Driver versions prior to 20.5) remotely.

• CWE-732
• CWE-732

• https://us-cert.cisa.gov/ics/advisories/icsa-20-338-01Mitigation, Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-20-338-01Mitigation, Third Party Advisory, US Government Resource

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25186An XXE vulnerability exists within LeviStudioU Release Build…7.5
• CVE-2020-25187Medtronic MyCareLink Smart 25000 is  vulnerable when an au…9.8
• CVE-2020-25188An attacker who convinces a valid user to open a specially c…7.8
• CVE-2020-25189The affected product is vulnerable to three stack-based buff…9.8
• CVE-2020-2519Vulnerability in the Oracle WebLogic Server product of Oracl…4.3
• CVE-2020-25190The built-in WEB server for MOXA NPort IAW5000A-I/O firmware…9.8
• CVE-2020-25192The built-in WEB server for MOXA NPort IAW5000A-I/O firmware…5.3
• CVE-2020-25193By having access to the hard-coded cryptographic key for GE …5.3
• CVE-2020-25194The built-in WEB server for MOXA NPort IAW5000A-I/O firmware…8.8
• CVE-2020-25195The length of the input fields of Host Engineering H0-ECOM10…7.5
• CVE-2020-25196The built-in WEB server for MOXA NPort IAW5000A-I/O firmware…9.8
• CVE-2020-25197A code injection vulnerability exists in one of the webpages…8.8