How severe is CVE-2020-6656?

CVE-2020-6656 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability low.

Is CVE-2020-6656 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-6656?

CVE-2020-6656 affects Eaton Easysoft. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-6656?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-6656 published?

CVE-2020-6656 was published on 2021-01-07 and last updated on 2026-06-17.

CVE-2020-6656

CVE-2020-6656 is a medium-severity vulnerability in Eaton Easysoft with a CVSS 3.x base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-843.

Key facts

Severity: Medium (CVSS 3.x base score 5.8)
CVSS v2: 6.8
EPSS exploit prediction: 3% (84th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-843
Affected product: Eaton Easysoft
Published: 2021-01-07
Last modified: 2026-06-17

Description

Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.

Frequently asked questions

What is CVE-2020-6656?: Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
How severe is CVE-2020-6656?: CVE-2020-6656 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity low, and availability low.
Is CVE-2020-6656 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-6656?: CVE-2020-6656 affects Eaton Easysoft. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-6656?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-6656 published?: CVE-2020-6656 was published on 2021-01-07 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:eaton:easysoft:*:*:*:*:*:*:*:*

More vulnerabilities in Eaton Easysoft

CVE-2026-22614 — Medium (CVSS 6.1): The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an…
CVE-2023-43777 — Medium (CVSS 5.9): Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining…
CVE-2020-6655 — Medium (CVSS 5.8): The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution…

All CVEs affecting Eaton Easysoft →

Other CWE-843 vulnerabilities

CVE-2021-33970 — Critical (CVSS 10.0): Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.
CVE-2010-2299 — Critical (CVSS 10.0): The Clipboard::DispatchObject function in app/clipboard/clipboard.cc in Google Chrome before 5.0.375.70 does not…
CVE-2023-22579 — Critical (CVSS 9.9): Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.
CVE-2026-13776 — Critical (CVSS 9.8): Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the…
CVE-2026-43038 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in…
CVE-2025-70023 — Critical (CVSS 9.8): An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.

Browse all CWE-843 vulnerabilities →