by Kastro
Paper/Archive/CVE-2020-7500

CVE-2020-7500

schneider — A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers an…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.7.797 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.

Affected

ProductAffectedFixed inSource
U.motion Servers and Touch Panels (affected versions listed in the security notification)U.motion Servers and Touch Panels (affected versions listed in the security notification)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refse.com/ww/en/download/document/SEVD-2020-133-03