CVE-2020-16202

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	WebAccess Node	All versions prior to 9.0.1

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-261-01Mitigation, Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-261-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Sep 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-162037.8Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a spec CVE-2020-162049.8The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as CVE-2020-162057.2Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1 CVE-2020-162069.0The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain ac CVE-2020-162077.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by openi CVE-2020-162088.8The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device CVE-2020-162099.8A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently CVE-2020-16215.5A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions o CVE-2020-162109.0The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and per CVE-2020-162115.5Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially CVE-2020-162126.8In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing un CVE-2020-162137.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user