CVE-2020-10613

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to disclose sensitive information due to the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122	Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122

References

https://www.us-cert.gov/ics/advisories/icsa-20-105-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-548/Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-20-105-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-548/Third Party Advisory, VDB Entry

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106144.8In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject CVE-2020-106157.5Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-servic CVE-2020-106168.8Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can CVE-2020-106177.5There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to CVE-2020-106185.5LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users.CVE-2020-106199.1An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.CVE-2020-10627.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt m CVE-2020-106209.8Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network CVE-2020-106219.8Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).CVE-2020-106227.8LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users CVE-2020-106236.5Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to CVE-2020-106247.5ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.