CVE-2020-10637

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted input file could trigger an out-of-bounds read when loaded by the affected product.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	Eaton HMiSoft VU3 (HMIVU3 runtime not impacted)	HMiSoft VU3 Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues.

References

https://www.us-cert.gov/ics/advisories/icsa-20-105-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-105-01Third Party Advisory, US Government Resource

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106389.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack CVE-2020-106397.8Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A CVE-2020-10647.5A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitra CVE-2020-106409.8Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote co CVE-2020-106417.5An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication.CVE-2020-106427.8In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could l CVE-2020-106435.4An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due CVE-2020-106447.5The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 CVE-2020-106467.8Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when par CVE-2020-106487.8Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a craft CVE-2020-106497.8DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additi CVE-2020-10654.2A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability co