Medium severity · published Sep 25, 2020
CVE-2020-16242
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application…
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
S2020 Firmware · GE
before 07a06 · source: NVD
SF
S2024 Firmware · GE
before 07a06 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16242
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
More from S2020 Firmware
6.1
CVE-2020-16246
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that…
5.4
CVE-2019-18267
An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior