CVE-2020-16201

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	Delta Industrial Automation CNCSoft ScreenEditor	Versions 1.01.23 and prior

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-941/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-942/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-944/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-945/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-946/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-947/Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-20-941/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-942/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-944/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-945/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-946/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-947/Third Party Advisory, VDB Entry

Timeline

Published: Aug 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-162027.8WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code exe CVE-2020-162037.8Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a spec CVE-2020-162049.8The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as CVE-2020-162057.2Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1 CVE-2020-162069.0The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain ac CVE-2020-162077.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by openi CVE-2020-162088.8The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device CVE-2020-162099.8A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently CVE-2020-16215.5A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions o CVE-2020-162109.0The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and per CVE-2020-162115.5Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially CVE-2020-162126.8In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing un