Vulnerability · Published Apr 9, 2020 · Assigned by icscert

CVE-2020-10617

High 7.5

In plain English

A high-severity SQL injection in WebAccess/NMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.3%top 30.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.

Affected products (as reported)

Vendor	Product	Versions
n/a	WebAccess/NMS	Versions prior to 3.0.2

Weakness: CWE-89

References

https://www.us-cert.gov/ics/advisories/icsa-20-098-01 x_refsource_MISC