CVE-2020-27254
mediumPriorität · verfolgen · 30EPSS 0.013 · 70. PerzentilEUUSEPSS · bewertet 2026-10-27
Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authentication for accessing log and backup data, which could allow an attacker with a specially crafted URL to obtain access to sensitive information.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationX-STREAM enhanced XEFDcisa_csaf_ot
In addition, Emerson recommends users of affected products continue to utilize current cybersecurity industry best practices. In the event such infrastructure is not implemented within an end user's network, action should be taken to ensure the affected products are connected to a well-protected network and properly segmented from the Internet. For more information on the Emerson Security notifications page.
https://www.emerson.com/en-us/support/security-notifications - MitigationX-STREAM enhanced XEGKcisa_csaf_ot
In addition, Emerson recommends users of affected products continue to utilize current cybersecurity industry best practices. In the event such infrastructure is not implemented within an end user's network, action should be taken to ensure the affected products are connected to a well-protected network and properly segmented from the Internet. For more information on the Emerson Security notifications page.
https://www.emerson.com/en-us/support/security-notifications - MitigationX-STREAM enhanced XEGPcisa_csaf_ot
In addition, Emerson recommends users of affected products continue to utilize current cybersecurity industry best practices. In the event such infrastructure is not implemented within an end user's network, action should be taken to ensure the affected products are connected to a well-protected network and properly segmented from the Internet. For more information on the Emerson Security notifications page.
https://www.emerson.com/en-us/support/security-notifications - MitigationX-STREAM enhanced XEXFcisa_csaf_ot
In addition, Emerson recommends users of affected products continue to utilize current cybersecurity industry best practices. In the event such infrastructure is not implemented within an end user's network, action should be taken to ensure the affected products are connected to a well-protected network and properly segmented from the Internet. For more information on the Emerson Security notifications page.
https://www.emerson.com/en-us/support/security-notifications
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (13)
Betroffene Produkte und Versionsbereiche.
- n/a Emerson Rosemount X-STREAM Gas Analyzer≤ X-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisionsenisa_euvdEU
- emerson x-stream enhanced xefd firmwarealle VersionennvdUScpe:2.3:o:emerson:x-stream_enhanced_xefd_firmware:*:*:*:*:*:*:*:*
- emerson x-stream enhanced xegk firmwarealle VersionennvdUScpe:2.3:o:emerson:x-stream_enhanced_xegk_firmware:*:*:*:*:*:*:*:*
- emerson x-stream enhanced xegp firmwarealle VersionennvdUScpe:2.3:o:emerson:x-stream_enhanced_xegp_firmware:*:*:*:*:*:*:*:*
- emerson x-stream enhanced xexf firmwarealle VersionennvdUScpe:2.3:o:emerson:x-stream_enhanced_xexf_firmware:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-20-352-01Emerson Rosemount X-STREAM2020-12-17icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker through a specially crafted URL to download files and obtain sensitive information.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-27254cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.4480/cnnvd
- https://www.emerson.com/documents/automation/xstream-notification-researcher-response-r1-en-7238504.pdfPatchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01enisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01Third Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan