PT-2020-20461 · American Dynamics+1 · American Dynamics Victor Web Client+1

Published 2020-10-08 · Updated 2022-10-29 · CVE-2020-9048

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions American Dynamics victor Web Client versions up to and including v5.4.1 Software House CCURE Web Client (affected versions not specified)

Description A remote unauthenticated attacker on the network could delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

Recommendations For American Dynamics victor Web Client versions up to and including v5.4.1, update to a version later than v5.4.1 to resolve the issue. For Software House CCURE Web Client, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Permission

Weakness Enumeration

CWE-285

CWE-732

Related Identifiers

CVE-2020-9048

Affected Products

American Dynamics Victor Web Client

Software House Ccure Web Client

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-9048 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9048 · Vendor Advisory
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Patch
• https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01 · Note
• https://t.me/cibsecurity/15165 · Telegram Post