CVE-2020-6977
Last modified
CVE-2020-6977 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ge | Vivid E95 Firmware | All versions |
| Ge | Vivid E90 Firmware | All versions |
| Ge | Vivid S70n Firmware | All versions |
| Ge | Vivid T8 Firmware | All versions |
| Ge | Vivid T9 Firmware | All versions |
| Ge | Vivid Iq Firmware | All versions |
| Ge | Logiq E10 Firmware | All versions |
| Ge | Logiq E9 Firmware | All versions |
| Ge | Logiq S8 Firmware | All versions |
| Ge | Logiq S7 Firmware | All versions |
| Ge | Logiq P9 Firmware | All versions |
| Ge | Logiq E9 With Xdclear Firmware | All versions |
| Ge | Voluson Firmware | All versions |
| Ge | Versana Essential Firmware | All versions |
| Ge | Invenia Abus Scan Station Firmware | All versions |
| Ge | Venue Go Firmware | All versions |
References
- https://www.us-cert.gov/ics/advisories/icsma-20-049-02Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsma-20-049-02Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-6977?
How severe is CVE-2020-6977?
How do I fix CVE-2020-6977?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-6971In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability…7.8
- CVE-2020-6972In Notifier Web Server (NWS) Version 3.50 and earlier, the H…9.1
- CVE-2020-6973Digi International ConnectPort LTS 32 MEI, Firmware Version …6.2
- CVE-2020-6974Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerab…9.8
- CVE-2020-6975Digi International ConnectPort LTS 32 MEI, Firmware Version …4.9
- CVE-2020-6976Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 a…5.5
- CVE-2020-6978In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affe…7.2
- CVE-2020-6979In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the…7.5
- CVE-2020-6980Rockwell Automation MicroLogix 1400 Controllers Series B v21…3.3
- CVE-2020-6981In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an …9.8
- CVE-2020-6982In Honeywell WIN-PAK 4.7.2, Web and prior versions, the head…8.8
- CVE-2020-6983In Moxa PT-7528 series firmware, Version 4.0 or lower, and P…7.5
Are you affected by CVE-2020-6977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST