CVE-2020-16246: ge s2020_firmware Cross-site Scripting
Vulnerability summary
CVE-2020-16246 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in ge s2020_firmware. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities.
Timeline
- 20-10-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site and executed by the victim client.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ge2 products
- s2020_firmware< 07a06
- s2024_firmware< 07a06
General electric1 product
- reason s20 ethernet switch≥ S2020, ≤ 07A06 | ≥ S2024, ≤ 07A06
2 vendors · 3 products
References
1 links
us-cert.cisa.gov/ics/advisories/icsa-20-266-02X Refsource MISCThird Party AdvisoryUS Government Resource