title: File parsing Type Confusion Remote code execution vulerability
description: Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.
problem types: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
affected:
{
product: easySoft Software
vendor: Eaton
versions:
status: affected, version: v7.xx prior to v7.22
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
]
solutions: Apply the patch once it is provided by Eaton.
workarounds: Do not upload the E70 file from an untrusted source.