CVE-2020-6650 Arbitrary code execution through “Update Manager” Class

High 8.3 Published 23 Mar 2020 Updated 16 Sep 2024

An attacker can execute arbitrary code on the host machine via an eval injection vulnerability in the update manager of Eaton UPS companion software.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6650?

CVE-2020-6650 is a high-severity code injection vulnerability in Eaton UPS Companion Software, published on 23 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.

Weakness: CWE-94, CWE-95

Which versions are affected by CVE-2020-6650?

It affects 1 product.

Products include Eaton Ups Companion.

How do I fix CVE-2020-6650?

No fix has been published for CVE-2020-6650 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-6650 being exploited?

There is no known exploitation of CVE-2020-6650 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-6xrc-w97f-j5jp.