File parsing Type Confusion Remote code execution vulerability
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.
Summary
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
Why it matters now
EPSS 0.02823 86th percentileScored 2026-11-07
Fix Fixed easySoft Software (Eaton): v7.22
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA easySoft Software (Eaton) Fixed in v7.22
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6656
- 2026-10-03 Alias added: GHSA-3vf9-hrcp-mj3p
References
Advisory 5
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/easySoft-eaton-vulnerability-advisory.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-20-1441/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1442/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1444/
- https://us-cert.cisa.gov/ics/advisories/icsa-21-007-03
More Eaton Easysoft vulnerabilities
- TI-2020-05474 File parsing Out-Of-Bounds read remote code execution CVSS 3.1HIGH 7.8
- TI-2023-23472 Insecure storage of password in easySoft CVSS 3.1MEDIUM 6.5
- TI-2026-18175 The encryption mechanism used in Eaton's EasySoft project file was insecure and… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-6656 · CVE Program
- CVE-2020-6656 · NVD
- FIRST EPSS
- GHSA-3vf9-hrcp-mj3p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences