CVE-2020-12002

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

VendorProductVersions
n/aAdvantech WebAccess NodeWebAccess Node Version 8.4.4 and prior, WebAccess Node Version 9.0.0

References

Timeline

Published
May 8, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-120037.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContCVE-2020-120047.5The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and IgnitCVE-2020-120057.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContCVE-2020-120069.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loCVE-2020-120079.8A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition duCVE-2020-120087.5Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order infoCVE-2020-120097.5A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnCVE-2020-12017.8An elevation of privilege vulnerability exists in the way the Windows Now Playing Session Manager handles objects in memory, aka 'Windows NoCVE-2020-120107.1Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an aCVE-2020-120119.8A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executiCVE-2020-120126.1Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,CVE-2020-120139.1A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mits
CVE-2020-12002: Critical severity, CVSS 9.8 | Vulnix