CVE-2020-16235

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
Emerson	Open Enterprise	>= All, <= 3.3.5

References

https://www.cisa.gov/uscert/ics/advisories/icsa-20-238-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-20-238-02Third Party Advisory, US Government Resource

Timeline

Published: May 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-162367.8FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an atta CVE-2020-162372.1Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the p CVE-2020-162386.7A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module CVE-2020-162394.9When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the clai CVE-2020-16245.5A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files CVE-2020-162405.3GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be down CVE-2020-162412.1Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor.CVE-2020-162426.1The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users CVE-2020-162437.8Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. Opening a specially CVE-2020-162447.2GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords.CVE-2020-162459.8Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker t CVE-2020-162466.1The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following