CVE-2020-6650
Arbitrary code execution through “Update Manager” Class
- Published
- Updated
- Reserved
- Assigned by
- Eaton
Description
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EatonCNA (assigner) | 3.1 | High8.3 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.1% · top 18% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.
Weakness
Affected products
Eaton · UPS Companion Software
- affected unspecified – ≤ 1.05
What to do
Solution: Download and install the latest version from product website.
Workaround: Connect the host machine behind firewall and do not expose directly to internet.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-6650)Record last updated .