CVE-2020-16209

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

VendorProductVersions
Fieldcomm GroupHART-IP Developer KitAll 1.0.0.0
Fieldcomm GrouphipserverAll 3.6.1

References

Timeline

Published
May 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-16215.5A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions oCVE-2020-162109.0The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perCVE-2020-162115.5Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially CVE-2020-162126.8In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unCVE-2020-162137.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user CVE-2020-162145.0In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated valCVE-2020-162157.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user CVE-2020-162166.5In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and priorCVE-2020-162177.8Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project fiCVE-2020-162183.5In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software does not neutralize or incorrectly neutralizes user-contrCVE-2020-162197.8Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. SuCVE-2020-16225.5A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSharedObjStore. This is
CVE-2020-16209: Critical severity, CVSS 9.8 | Vulnix