Lucene search

SchneiderCVE-2020-7506

HistoryJun 16, 2020 - 8:15 p.m.

CVE-2020-7506

2020-06-1620:15:15

CWE-200

schneider

web.nvd.nist.gov

cve-2020-7506

cwe-200

easergy t300

firmware

information exposure

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive with the firmware for the controller and modules using the usual tar archiver resulting in an information exposure.

Affected configurations

Nvd

Node

schneider-electriceasergy_t300Match-

AND

schneider-electriceasergy_t300_firmwareRange≤1.5.2

VendorProductVersionCPE
schneider-electriceasergy_t300-cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*
schneider-electriceasergy_t300_firmware*cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	easergy_t300	-	cpe:2.3:h:schneider-electric:easergy_t300:-:::::::*
schneider-electric	easergy_t300_firmware	*	cpe:2.3:o:schneider-electric:easergy_t300_firmware::::::::

CNA Affected

[
  {
    "product": "Easergy T300 Firmware V1.5.2 and prior",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Easergy T300 Firmware V1.5.2 and prior"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-04

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVE-2020-7506