High severity · published Mar 23, 2020
CVE-2020-6650
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability
8.8
CVSS
2.1%
EPSS
No
On KEV
Description
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
Ups Companion · Eaton
through 1.05 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6650
Patch
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-UPS-companion-software.pdf
More from Ups Companion
8.6
CVE-2025-59887
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software…
7.8
CVE-2025-67450
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This…
6.7
CVE-2025-59888
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system