CVE-2020-6994 - CVE House
Back to Database
Status published Critical CVE-2020-6994

A buffer overflow vulnerability was found in some devices of...

Vulnerability Description

A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-6994

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Hirschmann Automation and Control GmbH, a division of Belden Inc.

View all reports →

Affected Software

HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED, HiSecOS for device EAGLE20/30
Vulnerable Versions:
07.0.02 and lower, 03.2.00 and lower

Timeline

Official Publish: April 3rd, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-12

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.