CVE-2020-10622

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/aLCDS LAquis SCADA Versions 4.3.1 and priorLCDS LAquis SCADA Versions 4.3.1 and prior

References

Timeline

Published
May 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-106236.5Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to CVE-2020-106247.5ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.CVE-2020-106259.8WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.CVE-2020-106267.8In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with thCVE-2020-106278.1Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an InsCVE-2020-106287.5ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.CVE-2020-106297.5WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive fCVE-2020-10635.4A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web reqCVE-2020-106306.1SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input beforeCVE-2020-106319.8An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.CVE-2020-106325.3Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration fiCVE-2020-106336.1A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker
CVE-2020-10622: High severity, CVSS 7.8 | Vulnix