Lucene search

[email protected]CVE-2020-7489

HistoryApr 22, 2020 - 7:15 p.m.

CVE-2020-7489

2020-04-2219:15:11

CWE-74

[email protected]

web.nvd.nist.gov

cve-2020-7489

injection vulnerability

ecostruxure machine expert

nvd

security notification

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.6%

JSON

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.

Affected configurations

NVD

Node

schneider-electricecostruxure_machine_expert

schneider-electricsomachine_basic

Node

schneider-electricmodicon_m100Match-

AND

schneider-electricmodicon_m100_firmware

Node

schneider-electricmodicon_m200Match-

AND

schneider-electricmodicon_m200_firmware

Node

schneider-electricmodicon_m221Match-

AND

schneider-electricmodicon_m221_firmware

CPENameOperatorVersion
schneider-electric:ecostruxure_machine_expertschneider-electric ecostruxure machine experteq*
schneider-electric:somachine_basicschneider-electric somachine basiceq*

CPE	Name	Operator	Version
schneider-electric:ecostruxure_machine_expert	schneider-electric ecostruxure machine expert	eq	*
schneider-electric:somachine_basic	schneider-electric somachine basic	eq	*

CNA Affected

[
  {
    "product": "SoMachine Basic (all versions)EcoStruxure Machine Expert – Basic (all versions)Modicon M100 Logic Controller (all versions)Modicon M200 Logic Controller (all versions)Modicon M221 Logic Controller (all versions)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "SoMachine Basic (all versions)EcoStruxure Machine Expert – Basic (all versions)Modicon M100 Logic Controller (all versions)Modicon M200 Logic Controller (all versions)Modicon M221 Logic Controller (all versions)"
      }
    ]
  }
]

References

www.se.com/ww/en/download/document/SEVD-2020-105-01

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.6%

JSON

Related for CVE-2020-7489

nessus2 prion1 cvelist1 nvd1