CVE-2020-7480
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in...
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
- Record
CVE-2020-7480- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
- Record
CVE-2020-7480- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2020-28605 No score
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
- Record
EUVD-2020-28605- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqfj-275x-jhp4 No score
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in...
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
- Record
GHSA-mqfj-275x-jhp4- Updated
- 2026-11-02
Affected products
- schneider-electric andover continuum 5720 firmware
- schneider-electric andover continuum 5740 firmware
- schneider-electric andover continuum 9200 firmware
- schneider-electric andover continuum 9680 firmware
- schneider-electric andover continuum 9702 firmware
- schneider-electric andover continuum 9900 firmware
- schneider-electric andover continuum 9924 firmware
- schneider-electric andover continuum 9940 firmware
- schneider-electric andover continuum 9941 firmware
- schneider-electric andover continuum bcx4040 firmware
- schneider-electric andover continuum bcx9640 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7480 is a critical vulnerability (CVSS 9.8) in Schneider-electric Andover Continuum 5720 Firmware, published March 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. No source names a fixed version.