CVE-2020-14503

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Advantech iView	Versions 5.6 and prior

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-834/Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-834/Third Party Advisory, VDB Entry

Timeline

Published: Jul 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-145045.3The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacke CVE-2020-145059.8Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerab CVE-2020-145064.3Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrec CVE-2020-145079.8Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/dow CVE-2020-145089.8GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execu CVE-2020-145099.8Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify CVE-2020-14515.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-145109.8GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to e CVE-2020-145119.8Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and E CVE-2020-145127.5GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.CVE-2020-145137.5CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unver CVE-2020-145144.3All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further