Back
CVE-2020-6655
File parsing Out-Of-Bounds read remote code execution
Medium5.8EPSS 2.8%
- Published
- Updated
- Reserved
- Assigned by
- Eaton
Description
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EatonCNA (assigner) | 3.1 | Medium5.8 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.8% · top 14% of all CVEs (7 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
- affected v7.xx prior to v7.22
What to do
Solution: Apply the patch once it is provided by Eaton.
Workaround: Do not upload the E70 file from an untrusted source.
References (3)
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf (opens in a new tab)x_refsource_MISCx_transferred
- https://www.zerodayinitiative.com/advisories/ZDI-20-1443/ (opens in a new tab)x_refsource_MISCx_transferred
- https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-6655)Record last updated .