What’s Vulnerable › Vulnerabilities

CVE-2020-7480

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-23 · updated 2026-06-17
• Weakness: CWE-94

Description

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.

Affected products

• Schneider-Electric Andover Continuum 5720 Firmware: all versions
• Schneider-Electric Andover Continuum 5740 Firmware: all versions
• Schneider-Electric Andover Continuum 9200 Firmware: all versions
• Schneider-Electric Andover Continuum 9680 Firmware: all versions
• Schneider-Electric Andover Continuum 9702 Firmware: all versions
• Schneider-Electric Andover Continuum 9900 Firmware: all versions
• Schneider-Electric Andover Continuum 9924 Firmware: all versions
• Schneider-Electric Andover Continuum 9940 Firmware: all versions
• Schneider-Electric Andover Continuum 9941 Firmware: all versions
• Schneider-Electric Andover Continuum Bcx4040 Firmware: all versions
• Schneider-Electric Andover Continuum Bcx9640 Firmware: all versions

References

• https://www.se.com/ww/en/download/document/SEVD-2020-070-04/
• https://www.se.com/ww/en/download/document/SEVD-2020-070-04/

Get alerted when CVE-2020-7480 or the next vulnerability affects your stack