Lucene search

SchneiderCVE-2020-28216

HistoryDec 11, 2020 - 1:15 a.m.

CVE-2020-28216

2020-12-1101:15:11

CWE-311

schneider

web.nvd.nist.gov

cve-2020-28216

cwe-311

easergy t300

firmware

encryption

vulnerability

network traffic

http protocol

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol.

Affected configurations

Nvd

Node

schneider-electriceasergy_t300_firmwareRange≤2.7

AND

schneider-electriceasergy_t300Match-

VendorProductVersionCPE
schneider-electriceasergy_t300_firmware*cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*
schneider-electriceasergy_t300-cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	easergy_t300_firmware	*	cpe:2.3:o:schneider-electric:easergy_t300_firmware::::::::
schneider-electric	easergy_t300	-	cpe:2.3:h:schneider-electric:easergy_t300:-:::::::*

CNA Affected

[
  {
    "product": "Easergy T300 (firmware 2.7 and older)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Easergy T300 (firmware 2.7 and older)"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-343-03

www.se.com/ww/en/download/document/SEVD-2020-315-06/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVE-2020-28216