CVE-2020-10632

Executive Summary

CVE-2020-10632 is a local privilege escalation vulnerability in Emerson OpenEnterprise versions through 3.3.4, caused by inadequate folder security permissions that permit modification of critical configuration files. Successful exploitation allows an authenticated local attacker to alter application configuration, potentially causing the industrial control system (ICS) historian software — widely deployed in oil & gas, chemical, and critical infrastructure sectors — to fail or behave unpredictably. Emerson has issued a fix via OpenEnterprise Service Pack 5 (3.3.5), available on their SupportNet portal. With a CVSS score of 8.8 and a patch confidence of only 2/4, enterprise security teams should prioritize verification of the vendor-issued fix. Advisory ICSA-20-140-02 was originally released by CISA on May 19, 2020.

Technical Analysis

The vulnerability pertains to Emerson OpenEnterprise — an industrial control system (ICS) platform serving as a production management/historian solution. The security issue stems from inadequate folder security permissions on Windows-based installations of the software.

The exact folder paths and configuration file names are not disclosed in the NVD description; however, the vulnerability class is well-understood: the software installs directories and configuration files with overly permissive discretionary access control lists (DACLs). Under the principle of least privilege, installation processes often default to granting broad permissions (e.g., Everyone Modify, Users Full Control) to working directories and config stores.

Attack surface: An authenticated local user (standard user account) can traverse the filesystem to locate OpenEnterprise installation directories and configuration files. Because these filesystem objects carry permissions that allow modification by non-administrative accounts, the attacker can alter the configuration files to manipulate how the application behaves.

Failure impact: The NVD description explicitly states that modification of these configuration files "could cause the system to fail or behave in an unpredictable manner." In an ICS/SCADA context, this is particularly dangerous because:

1. OpenEnterprise functions as an industrial data historian, aggregating process data from controllers, HMIs, and other OT devices.
2. Configuration files control database connections, communication endpoints, and data collection parameters.
3. Silent corruption or malicious modification could result in data loss, falsified process data, or service outage.

The description provides no specific code-level detail. Insufficient technical detail is available to enumerate the exact configuration filenames, registry keys, or folder paths. The vulnerability mechanism is best characterized as a CWE-732 (Incorrect Permission Assignment for Critical Resource) issue.

Exploitation Scenarios

No public PoC exists for this vulnerability; the attack chain below is inferred from the vulnerability class (weak folder permissions on configuration files) and the NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker with a local user account on a Windows host running OpenEnterprise must first identify the installation directory. Typical locations might include C:\Program Files\Emerson\OpenEnterprise or C:\Program Files (x86)\OpenEnterprise (these paths are inferred from vendor conventions and NOT specified in the official advisory — treat as plausible but unverified). The attacker may enumerate filesystem ACLs using standard Windows utilities (e.g., icacls, cacls) to identify directories granting write access to the current user.

Step 2 — Triggering the Flaw: Once a writable configuration folder is located, the user — without elevation — modifies or overwrites configuration files used by the OpenEnterprise runtime services. The system fails to restrict write access because folder DACLs do not enforce least privilege.

Step 3 — Payload/Execution Method: The attacker crafts or alters configuration content so that upon the next service startup, the configuration is parsed with malicious parameters. Examples of what can be altered (based on the vulnerability class — NOT inventoried specifics):

• Modify database connection strings to point to a rogue SQL server.
• Alter communication parameters to redirect data collection to attacker-controlled endpoints.
• Inject invalid or crash-causing parameters to force a denial-of-service condition on the historian service.

Step 4 — Post-Exploitation Impact: Upon service restart, OpenEnterprise consumes the tampered configuration, causing the system to fail or behave unpredictably as described. Escalated outcomes include persistent denial of service, loss of process data integrity, or pivoting into the wider OT network via altered connection settings.

Impact Assessment

CVSS: 8.8 (High) — The NVD description does not provide a formal CVSS vector, but the assigned score of 8.8 reflects the following impact profile (inferred):

• Confidentiality: High — configuration files may disclose internal network topology, credentials, or database connection strings to the low-privileged attacker.
• Integrity: High — configuration modification is the core vulnerability, enabling direct, persistent compromise of data correctness.
• Availability: High — the NVD description explicitly states the system "could ... fail."

Attack complexity: Low; the attacker needs only local write access to a folder, and no special conditions must be met beyond standard user privileges. Attack vector: Local (requires a pre-existing local user account). Privileges required: Low. User interaction: None. Scope: Changed — the compromised configuration can affect a wider scope than the attacker's original privileges.

Blast radius: OpenEnterprise is deployed in critical infrastructure sectors including energy, water, and manufacturing. Compromise of an industrial historian can affect compliance reporting, process optimization, safety systems, and regulatory filings. In regulated industries, falsified process data carries regulatory and legal liabilities.

Detection Guidance

The detection rules below target indicators consistent with exploitation of CWE-732: unexpected writes to program directories, ACL changes on application folders, and file modification events in non-standard locations.

Sigma Rule

title: Potential Modification of Emerson OpenEnterprise Configuration Files
id: 7d2b4a10-9b3e-4f4a-9a1c-1a2b3c4d5e6f
status: experimental
description: Detect unauthorized file writes to Emerson OpenEnterprise installation folders, indicative of CVE-2020-10632 exploitation
tags:
    - attack.t1222
    - attack.defense_evasion
    - cve.2020-10632
logsource:
    product: windows
    category: file_event
detection:
    selection_path:
        TargetFilename|contains:
            - 'OpenEnterprise\config'
            - 'OpenEnterprise\Configuration'
            - 'OpenEnterprise\Data'
            - 'Emerson\OpenEnterprise'
    selection_user:
        User|endswith:
            - 'NETWORK SERVICE'
            - 'LOCAL SERVICE'
    condition: selection_path and not selection_user
level: high
falsepositives:
    - Legitimate Emerson service account updates during patch installation
    - System administrator modifications during routine maintenance

YARA Rule

rule CVE_2020_10632_OpenEnterprise_Config
{
    meta:
        author = "Valters IT Security"
        description = "Detect evidence of tampered Emerson OpenEnterprise configuration files"
        cve = "CVE-2020-10632"
        date = "2024-01-01"
    strings:
        $a = "OpenEnterprise" ascii wide nocase
        $b = "ConfigurationFile" ascii wide nocase
        $c = "INIT" ascii wide nocase
        $d = "ServerName" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        (2 of ($a, $b, $c, $d) and filesize < 10MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2020-10632 Emerson OpenEnterprise Configuration Tampering"; flow:established,to_server; content:"OpenEnterprise"; http_uri; nocase; content:"config"; http_uri; nocase; content:"GET"; http_method; startswith:"GET"; threshold:type both, track by_src, count 5, seconds 300; classtype:attempted-admin; sid:202010632; rev:1;)

Note: Since CVE-2020-10632 is a local file permission issue, network detection is limited. This rule watches for suspicious HTTP traffic targeting OpenEnterprise-related endpoints as a secondary indicator.

Elastic Detection

eql
sequence by user.name with maxspan=5m
  [ authentication where process.name == "svchost.exe" and event.action == "logon" ]
  [ file where event.action in ("write", "modify") and file.name like "*OpenEnterprise*" ]
  [ file where event.action in ("write", "modify") and file.name like "*.config" ]

This sequence detection identifies a user logging on and subsequently writing to OpenEnterprise-related files, a pattern consistent with exploitation.

Splunk SPL Query

index=windows EventCode=4663
| search (Object_Name="*OpenEnterprise*" OR TargetFilename="*OpenEnterprise*")
| lookup privilege_lookup Process_Name
| eval threat = case(
    match(SubjectUserName, "^(?!(SYSTEM|LOCAL SERVICE|NETWORK SERVICE)$).*"), "non-service-account-access",
    1=1, "benign")
| where threat="non-service-account-access"
| table _time, SubjectUserName, Object_Name, Process_Name, Accesses
| stats count by SubjectUserName, Object_Name
| sort -count

Detects Windows 4663 (object access) events pointing to OpenEnterprise file paths by non-service accounts.

Wazuh OSSEC Rule

<group name="OpenEnterprise,">
    <rule id="100632" level="12">
        <if_sid>554</if_sid>
        <match>OpenEnterprise</match>
        <regex>\.config</regex>
        <description>OpenEnterprise configuration file modification detected - potential CVE-2020-10632 exploitation</description>
        <group>configuration_change,</group>
        <mitre>
            <id>T1222</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed). This indicates the fix is claimed by Emerson but not independently verified by third-party researchers or the security research community.

1. Immediate Mitigations (before patching):

   • Audit and tighten filesystem ACLs on all OpenEnterprise installation directories proactively, removing Modify/Write permissions for non-privileged users and non-service accounts.
   • Restrict interactive logon rights to OT/ICS hosts; enforce that only authorized IT/OT personnel can log on locally.
   • Segregate the OpenEnterprise host on a dedicated OT network segment with strict host-based firewall rules.
   • Monitor all file writes to OpenEnterprise application folders using the detection rules above.

2. Patch / Upgrade Steps:

   • Upgrade to OpenEnterprise 3.3, Service Pack 5 (3.3.5).
   • Access the patch through the Emerson SupportNet system (login required); navigate to the downloads area.
   • For support or access issues: https://www.emerson.com/en-us/support or contact Emerson directly (US: 800-537-9313; international toll-free numbers available).
   • After upgrading, verify folder ACLs are tightened and re-run a permissions audit against the application directory.
   • Due to the 2/4 patch confidence, do not disable perimeter defenses after patching — confirm the fix through independent testing before assuming full remediation.

3. Long-Term Hardening:

   • Adopt a least-privilege baseline for all OT hosts: no standard user accounts should have write permissions to application directories.
   • Implement application allow-listing (e.g., AppLocker, WDAC) on OT hosts to restrict unauthorized process execution.
   • Centralize OT asset and patch management with a documented change-management process that includes ACL review.
   • Enforce multi-factor authentication for all remote access into the OT environment.
   • Regularly backup OpenEnterprise configuration files and validate restore procedures to support rapid recovery from tampering.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-10632 (official NVD record; minimal technical detail, references ICSA advisory)
2. CISA Advisory ICSA-20-140-02: https://www.cisa.gov/news-events/ics-advisories/icsa-20-140-02 (vendor advisory detailing patch instructions and affected versions)
3. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (confirmed: CVE-2020-10632 is NOT in KEV as of assessment date)
4. Emerson SupportNet: https://www.emerson.com/en-us/support (patch download portal — requires authenticated access)

Threat actor / exploit-in-the-wild evidence: No public exploit code, Nuclei template, or indication of active in-the-wild exploitation (EPSS score: 0.00473, placing it in the 38.5th percentile — low probability of exploitation). No threat actor campaigns are publicly associated with this CVE at the time of writing.