CVE-2020-9048 - victor Web Client - Arbitrary File Deletion Vulnerability

Back Back to CVE browser

HIGH

victor Web Client - Arbitrary File Deletion Vulnerability

Published Oct 8, 2020

8.1

HIGH

CVSS 3.1

EPSS 1.13%

Description

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

Affected products

Vendor Johnson Controls Product victor Web Client version 5.4.1 and prior Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=5.4.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Johnson Controls

victor Web Client version 5.4.1 and prior

n/a

Version	Status	Constraints
unspecified	affected	<=5.4.1

Remediation

Vendor solution

Upgrade all versions of victor Web Client to v5.6

Registered users can obtain the critical software update by downloading the update found here: https://www.americandynamics.net/support/SoftwareDownloads.aspx.

Weaknesses (2)

CWE-285

CWE-732

Incorrect Permission Assignment

References (2)

https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01
third-party-advisoryx_refsource_CERTMitigationThird Party AdvisoryUS Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
x_refsource_CONFIRMPatchThird Party Advisory

Link	Providers	Tags
https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01		third-party-advisoryx_refsource_CERTMitigationThird Party AdvisoryUS Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories		x_refsource_CONFIRMPatchThird Party Advisory