Skip to content
OpenAdvisories
High · 8.3 Public exploit CVE-2020-6650 EUVD-2020-27797GHSA-6xrc-w97f-j5jp

Arbitrary code execution through “Update Manager” Class

Published Mar 23, 2020 · Updated Sep 16, 2024 · Assigned by Eaton

Vendor: Eaton Product: UPS Companion software

Description

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.

Affected products

VendorProductAffectedFixed
Eaton UPS Companion Software unspecified – ≤ 1.05 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • RavSS/Eaton-UPS-Companion-Exploit ★ 1 · Oct 25, 2019

    This repository details CVE-2020-6650, a vulnerability I discovered within Eaton's UPS Companion. All users should upgrade to v1.06 immediately or else they risk remote administrator access to their …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References