CVE-2020-11420

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-27 · updated 2026-06-17
Weakness: CWE-22

Description

UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may access arbitrary files and directories stored in the file system, but integrity of the files are not jeopardized as attacker have read access rights only.

Affected products

ABB Cs141 Firmware: from 1.66 through 1.88
Generex UPS CS141: before 1.90 — fixed in 1.90

How to fix

Upgrade to a fixed version: Generex UPS CS141 1.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11420 or the next vulnerability affects your stack