High severity · published Jan 7, 2021
CVE-2020-6655
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability
7.8
CVSS
2.8%
EPSS
No
On KEV
Description
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Easysoft · Eaton
7.00 before 7.22 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6655
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03
Vendor Advisory
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1443/
More from Easysoft
7.8
CVE-2020-6656
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability
6.5
CVE-2023-43777
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays
6.1
CVE-2026-22614
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine…
5.9
CVE-2026-41022
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices