s::can moni::tools autheticated SQL injection
Priority MEDIUM 42CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of confidentiality, loss of integrity and DoS.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00832 57th percentileScored 2026-11-07
Fix Fixed moni:tools (s::can): 4.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Badger Meter | moni:tools | 1.0 to before 4.2 | 4.2 | Patch available | CNA |
- moni:tools VendorBadger Meter Affected 1.0 to before 4.2 Fixed in 4.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:badgermeter:moni\:\:tool:4.2:*:*:*:*:*:*:* | tool | Vulnerable | Badger Meter |
- cpe:2.3:a:badgermeter:moni\:\:tool:4.2:*:*:*:*:*:*:* Versions tool Vulnerable ·Badger Meter
Remediation
- Fix · CNA moni:tools (s::can) Fixed in 4.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12507
- 2026-10-03 Alias added: GHSA-h6x8-4mx9-224h
References
More Badger Meter Moni vulnerabilities
- TI-2020-10004 s::can moni::tools prone to path traversal in camera-file module CVSS 3.1HIGH 7.5
- TI-2020-10003 s::can moni::tools prone to path traversal in image-relocator module CVSS 3.1HIGH 7.5
Sources
- CVE-2020-12507 · CVE Program
- CVE-2020-12507 · NVD
- FIRST EPSS
- GHSA-h6x8-4mx9-224h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences