CVE-2020-11496 Command injection in n/a
Local attackers with access to engineering data can inject arbitrary commands into parameter files, leading to code execution on the device.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11496?
CVE-2020-11496 is a medium-severity command injection vulnerability in n/a, published on 19 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the validation of the input values on the device side, which is provided by the engineering software during parameterization. Attackers with access to local configuration files can therefore insert malicious commands that are executed after compiling them to valid parameter files (“PDLs”), transferring them to the device, and restarting the device.
Which versions are affected by CVE-2020-11496?
It affects 1 product.
Products include Sprecher-Automation Sprecon-E.
How do I fix CVE-2020-11496?
No fix has been published for CVE-2020-11496 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-11496 being exploited?
There is no known exploitation of CVE-2020-11496 in the wild and no public exploit code.
Sources
Also known as GHSA-xw7r-78c6-fpj4.