CVE-2020-9404

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-11 · updated 2026-06-17
Weakness: CWE-522

Description

In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no knowledge of the current passwords.

Affected products

Pactware: from 5.0 before 5.0.5.31; 2.4-sp5, 3.0-sp4, 3.5, 3.6-sp1 — fixed in 5.0.5.31

How to fix

Upgrade to a fixed version: Pactware 5.0.5.31. Check the vendor advisory for mitigations.

References

https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf
https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf

Get alerted when CVE-2020-9404 or the next vulnerability affects your stack