Lucene search

SchneiderCVE-2020-7505

HistoryJun 16, 2020 - 8:15 p.m.

CVE-2020-7505

2020-06-1620:15:15

CWE-494

schneider

web.nvd.nist.gov

easergy t300

firmware

cwe-494

cve-2020-7505

integrity check

arbitrary code

nvd

security

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system.

Affected configurations

Nvd

Node

schneider-electriceasergy_t300Match-

AND

schneider-electriceasergy_t300_firmwareRange≤1.5.2

VendorProductVersionCPE
schneider-electriceasergy_t300-cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*
schneider-electriceasergy_t300_firmware*cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	easergy_t300	-	cpe:2.3:h:schneider-electric:easergy_t300:-:::::::*
schneider-electric	easergy_t300_firmware	*	cpe:2.3:o:schneider-electric:easergy_t300_firmware::::::::

CNA Affected

[
  {
    "product": "Easergy T300 (Firmware version 1.5.2 and older)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Easergy T300 (Firmware version 1.5.2 and older)"
      }
    ]
  }
]

References

www.se.com/ww/en/download/document/SEVD-2020-161-04

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

43.1%

JSON

Related for CVE-2020-7505