CVE-2020-12022

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-120234.5Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue CVE-2020-120246.1Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to theCVE-2020-120253.3Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, whCVE-2020-120268.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loCVE-2020-120274.3All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacCVE-2020-120288.1In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data CVE-2020-120297.8All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attackCVE-2020-12037.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to pCVE-2020-1203010.0There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables thCVE-2020-120317.8In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated aCVE-2020-120329.1Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in CVE-2020-120338.8In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied id
CVE-2020-12022: Critical severity, CVSS 9.8 | Vulnix