CVE-2020-7480
Last modified
CVE-2020-7480 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.. EPSS estimates a 1.50% chance of exploitation in the next 30 days.
Description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Andover Continuum 9680 Firmware | All versions |
| Schneider-Electric | Andover Continuum 5740 Firmware | All versions |
| Schneider-Electric | Andover Continuum 5720 Firmware | All versions |
| Schneider-Electric | Andover Continuum Bcx4040 Firmware | All versions |
| Schneider-Electric | Andover Continuum Bcx9640 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9900 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9940 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9941 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9924 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9702 Firmware | All versions |
| Schneider-Electric | Andover Continuum 9200 Firmware | All versions |
References
- https://www.se.com/ww/en/download/document/SEVD-2020-070-04/Vendor Advisory
- https://www.se.com/ww/en/download/document/SEVD-2020-070-04/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-7480?
How severe is CVE-2020-7480?
How do I fix CVE-2020-7480?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-7474A CWE-427: Uncontrolled Search Path Element vulnerability ex…7.8
- CVE-2020-7475A CWE-74: Improper Neutralization of Special Elements in Out…9.8
- CVE-2020-7476A CWE-426: Untrusted Search Path vulnerability exists in Zig…7.8
- CVE-2020-7477A CWE-754: Improper Check for Unusual or Exceptional Conditi…7.5
- CVE-2020-7478A CWE-22: Improper Limitation of a Pathname to a Restricted …7.5
- CVE-2020-7479A CWE-306: Missing Authentication for Critical Function vuln…7.8
- CVE-2020-7481A CWE-79:Improper Neutralization of Input During Web Page Ge…6.1
- CVE-2020-7482A CWE-79:Improper Neutralization of Input During Web Page Ge…6.1
- CVE-2020-7483**VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability coul…7.5
- CVE-2020-7484**VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability with…7.5
- CVE-2020-7485**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support acc…9.8
- CVE-2020-7486**VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability coul…7.5
Are you affected by CVE-2020-7480?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST