Lucene search

[email protected]CVE-2020-7491

HistoryJul 23, 2020 - 9:15 p.m.

CVE-2020-7491

2020-07-2321:15:12

[email protected]

web.nvd.nist.gov

cve-2020-7491

legacy

debug port

tcm

tricon system

network access

vulnerability

remediation

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

VERSION NOT SUPPORTED WHEN ASSIGNED A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4.

Affected configurations

NVD

Node

schneider-electrictricon_tcm_4351Match-

AND

schneider-electrictricon_tcm_4351_firmwareRange10.2.0–10.5.4

Node

schneider-electrictricon_tcm_4352Match-

AND

schneider-electrictricon_tcm_4352_firmwareRange10.2.0–10.5.4

Node

schneider-electrictricon_tcm_4351aMatch-

AND

schneider-electrictricon_tcm_4351a_firmwareRange10.2.0–10.5.4

Node

schneider-electrictricon_tcm_4351bMatch-

AND

schneider-electrictricon_tcm_4351b_firmwareRange10.2.0–10.5.4

Node

schneider-electrictricon_tcm_4352aMatch-

AND

schneider-electrictricon_tcm_4352a_firmwareRange10.2.0–10.5.4

Node

schneider-electrictricon_tcm_4352bMatch-

AND

schneider-electrictricon_tcm_4352b_firmwareRange10.2.0–10.5.4

Node

schneider-electrictristation_1131Match-

AND

schneider-electrictristation_1131_firmwareRange1.0.0–4.9.0

schneider-electrictristation_1131_firmwareRange4.10.0–4.12.0

CPENameOperatorVersion
schneider-electric:tricon_tcm_4351_firmwareschneider-electric tricon tcm 4351 firmwarelt10.5.4

CPE	Name	Operator	Version
schneider-electric:tricon_tcm_4351_firmware	schneider-electric tricon tcm 4351 firmware	lt	10.5.4

CNA Affected

[
  {
    "product": "Tricon system versions 10.2.0 through 10.5.3",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Tricon system versions 10.2.0 through 10.5.3"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-205-01

www.se.com/ww/en/download/document/SESB-2020-105-01/

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.3%

JSON

Related for CVE-2020-7491

prion1 cvelist1 nvd1 ics1 threatpost1