Medium severity · published May 19, 2022
CVE-2020-16235
Emerson OpenEnterprise - Inadequate Encryption Strength
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Open Enterprise · Emerson
All through 3.3.5 · source: vendor
OS
Openenterprise Scada Server · Emerson
through 3.3.5 · source: NVD