7.8

CVE-2020-10626

In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code.

Data is provided by the National Vulnerability Database (NVD)
Fazecast ≫ Jserialcomm Version <= 2.2.2
Schneider-electric ≫ Ecostruxure It Gateway Version >= 1.5.0.66 <= 1.5.2.28
Schneider-electric ≫ Ecostruxure It Gateway Version >= 1.6.0.39 <= 1.6.2.14
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.17
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

https://www.us-cert.gov/ics/advisories/ICSA2012601
Third Party Advisory
US Government Resource