PT-2020-2066 · Yokogawa · Tristation

Published 2020-04-14 · Updated 2023-03-01 · CVE-2020-7485

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TriStation versions prior to 4.9.1 TriStation versions prior to 4.10.1

Description A legacy support account in the TriStation software could cause improper access to the TriStation host machine. The issue is related to the presence of a predefined account. Exploitation of this issue may allow a remote attacker to gain unauthorized access to the TriStation host machine.

Recommendations For TriStation versions prior to 4.9.1, update to version 4.9.1 or later to resolve the issue. For TriStation versions prior to 4.10.1, update to version 4.10.1 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-01900

CVE-2020-7485

Affected Products

Tristation

References · 7

• https://osv.dev/vulnerability/CVE-2020-7485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7485 · Security Note
• https://bdu.fstec.ru/vul/2020-01900 · Security Note
• https://se.com/ww/en/download/document/SESB-2020-105-01 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01 · Note
• https://t.me/cvenotify/2854 · Telegram Post
• https://vuldb.com/?id.154025 · Note