CVE-2020-13435

lowpriority · track · 22EPSS 0.006 · 50 %ileCHDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.64% (50th) EPSS
CVSS 2.1 · low
Is it mine?
49 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · abb_psirt

EPSS · scored 2026-10-23

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAbility Camera Connectabb_psirt

    The problem is corrected in the following product versions: - ABB Ability Camera Connect 2.0.0.49. The easiest path to mitigate the problem is an update of ABB Ability Camera Connect system by the customer. ABB recommends that customers apply the update at earliest convenience.

  • FixedAutomation Studioabb_psirt

    The problem is corrected in the following product versions: B&R Automation Studio 6.5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)siemens_psirt

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot

    Update to V3.1.5 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedB&R Automation Studiocisa_csaf_ot

    The problem is corrected in the following product versions: B&R Automation Studio 6.5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

  • MitigationAbility Camera Connectabb_psirt

    This vulnerability results in a segmentation fault (application crash): - Denial of Service Impact: A segmentation fault leads to application crash, representing a denial of service rather than data breach or code execution. In industrial environments, application monitoring and automatic re-start mechanisms can quickly restore service. - Query Complexity: The vulnerability requires specific expression patterns in SQL queries. Camera Connect's predefined query templates and parameterized queries reduce the likelihood of triggering this condition. - High Availability Design: OT solutions typically incorporate redundancy and failover mechanisms to maintain operational continuity in the event of application failures. - Limited Window: In a segmentation fault scenario, the application terminates immediately, limiting any potential data exposure compared to vulnerabilities that allow sustained unauthorized access. - Operational Monitoring: Industrial control systems maintain operational monitoring that alerts operators to application failures, enabling rapid response. While denial of service is undesirable in OT environments, the impact is significantly less severe than vulnerabilities allowing unauthorized access or data manipulation.

  • MitigationAutomation Studioabb_psirt

    Refer to section “General security recommendations” for advice on how to keep your system secure.

  • MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot

    Only build and run applications from trusted sources.

  • MitigationB&R Automation Studiocisa_csaf_ot

    Refer to section “General security recommendations” for advice on how to keep your system secure.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.1–7.5

v2.02.1lowAV:L/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 2.9
v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · ABB PSIRT
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-476USprimaryCWE-476USCWE-476USCWE-476USCWE-476US
04

affected products (49)

Products and version ranges known to be affected.

showing 20 of 49
05

advisories (9)

Vendor and ecosystem advisories describing this.

  • 4HZM000604ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)2026-03-26csaf · abb_psirtCH

    ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.

  • SA25P007B&R Automation Studio Update of SQLite version2026-02-18csaf · abb_psirtCH

    ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.

  • SSA-398330SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.52023-12-12csaf · siemens_psirtDE

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 (https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • WID-SEC-W-2023-0856IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2022-05-31csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2023-1614Tenable Security Nessus Network Monitor: Mehrere SchwachstellenDeutsch2023-06-29csaf · cert_bundDE

    Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.

  • WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.

  • ICSA-23-348-10Siemens SIMATIC S7-15002023-12-12icsa · cisa_csaf_otUS

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • ICSA-26-141-03ABB B&R Automation Studio2026-02-18icsa · cisa_csaf_otUS

    ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.

  • BIT-sqlite-2020-134352024-03-06vendor · osvUS

    SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduabb_psirtcert_bundcisa_csaf_otsiemens_psirtosvNVDCVE.orgMITRE
published 2020-05-24modified 2026-06-17
09

references (114)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan