CVE-2020-12006

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
n/a	Advantech WebAccess Node	WebAccess Node Version 8.4.4 and prior, WebAccess Node Version 9.0.0

References

https://www.us-cert.gov/ics/advisories/icsa-20-128-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-589/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-595/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-605/Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-20-128-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-589/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-595/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-605/Third Party Advisory, VDB Entry

Timeline

Published: May 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-120079.8A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition du CVE-2020-120087.5Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order info CVE-2020-120097.5A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vuln CVE-2020-12017.8An elevation of privilege vulnerability exists in the way the Windows Now Playing Session Manager handles objects in memory, aka 'Windows No CVE-2020-120107.1Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an a CVE-2020-120119.8A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executi CVE-2020-120126.1Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,CVE-2020-120139.1A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mits CVE-2020-120147.5Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL co CVE-2020-120157.5A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserializat CVE-2020-120169.8Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,CVE-2020-120179.8GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web app