CVE-2020-9048
victor Web Client - Arbitrary File Deletion Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
victor Web Client - Arbitrary File Deletion Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
- Record
CVE-2020-9048- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2020-29877
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
- Record
EUVD-2020-29877- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c36-q7xc-rp9j
A vulnerability in victor Web Client versions up to and including v5.4.1 could allow a remote...
A vulnerability in victor Web Client versions up to and including v5.4.1 could allow a remote unauthenticated attacker to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
- Record
GHSA-9c36-q7xc-rp9j- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
NVD
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
- Record
CVE-2020-9048- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 7.8 High
AV:A/AC:L/Au:N/C:N/I:C/A:C - Weakness
- CWE-285, CWE-732
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9048 is a high vulnerability (CVSS 7.1) in Johnsoncontrols Victor Web Client, published October 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. No source names a fixed version.