CVE-2020-6650: eaton ups_companion Eval Injection
Vulnerability summary
CVE-2020-6650 is a high (CVSS 8.8) Eval Injection vulnerability in eaton ups_companion. EPSS estimates a 2.10% chance of exploitation in the next 30 days, higher than 81.5% of scored vulnerabilities.
Timeline
- 23-03-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA8.3HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.10%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.10% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Eaton2 products
- ups_companion≤ 1.05
- ups companion software≥ unspecified, ≤ 1.05
1 vendor · 2 products