Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2020-6650Arbitrary code execution through “Update Manager” Class

Description

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.

Timeline

  1. ID reserved

    By Eaton

  2. · 2 months later

    Published

  3. · 4 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-6650, by who scored it
Scored byCVSSScoreVector
EatonCNA (assigner)3.1High8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Modified3.1High8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
2.1% · top 18% of all CVEs (14 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Affected products

What to do

Solution: Download and install the latest version from product website.

Workaround: Connect the host machine behind firewall and do not expose directly to internet.

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2020-6650 badge
[![CVE-2020-6650](https://cveledger.app/badge/CVE-2020-6650.svg)](https://cveledger.app/cve/CVE-2020-6650)

Record last updated .