CVE-2020-14498: HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute…

PriorityP261critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

2.90%

85.2th percentile

HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
hms-networks	ecatcher	< 6.5.5	6.5.5
hms_industrial_networks_ab	ecatcher	< 6.5.5	6.5.5

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is a stack-based buffer overflow (CWE-121) in HMS Industrial Networks eCatcher VPN client, all versions prior to 6.5.5; exploitable remotely with no privileges required but requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) ↗
→Successful exploitation can crash the device and enable remote code execution with highest privileges; monitor eCatcher processes for anomalous crashes or privilege escalation ↗

·No known public exploits specifically target this vulnerability at time of advisory publication; exploitation requires user interaction (UI:R) ↗
·All eCatcher versions prior to 6.5.5 are affected; version 6.5.5 and later are patched ↗

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.