CVE-2020-14502

Summary

The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web interface.

Affected Software

VendorProductVersion RangeStatus
Rockwell Automation1734-AENTRSeries B 4.001 to 4.005, and 5.011 to 5.017affected
Rockwell Automation1734-AENTRSeries C 6.011 and 6.012affected

Weaknesses

  • CWE-79: CWE-79 Cross-site Scripting (XSS)

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References