CVE-2020-6656

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-843

Affected software

Vendor	Product	Versions
Eaton	easySoft Software	v7.xx prior to v7.22

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03Third Party Advisory, US Government Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1441/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1442/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1444/Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03Third Party Advisory, US Government Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1441/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1442/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1444/Third Party Advisory, VDB Entry

Timeline

Published: Jan 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-67505.9GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server wh CVE-2020-67523.8In OMERO before 5.6.1, group owners can access members' data in other groups.CVE-2020-67536.1The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.CVE-2020-67549.8dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute file CVE-2020-67569.8languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code CVE-2020-67578.8contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute c CVE-2020-67586.1A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows rem CVE-2020-67609.8Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcomma CVE-2020-67657.2D-Link DSL-GS225 J1 AU_1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as CVE-2020-67676.5A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to re CVE-2020-67687.5A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to r CVE-2020-67699.1Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retriev