CVE-2020-10623

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	WebAccess/NMS	Versions prior to 3.0.2

References

https://www.us-cert.gov/ics/advisories/icsa-20-098-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-098-01Third Party Advisory, US Government Resource

Timeline

Published: Apr 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106247.5ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.CVE-2020-106259.8WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.CVE-2020-106267.8In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with th CVE-2020-106278.1Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Ins CVE-2020-106287.5ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.CVE-2020-106297.5WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive f CVE-2020-10635.4A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web req CVE-2020-106306.1SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input before CVE-2020-106319.8An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.CVE-2020-106325.3Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration fi CVE-2020-106336.1A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker CVE-2020-106349.1SAE IT-systems FW-50 Remote Telemetry Unit (RTU). A specially crafted request could allow an attacker to view the file structure of the affe