Schneider Electric EcoStruxure Operator Terminal Expert

🗓️ 21 May 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 131 Views

Schneider Electric EcoStruxure Operator Terminal Expert vulnerabilities: SQL Injection, Path Traversal, Argument Injection. Unauthorized write access or remote code execution risk. Mitigations include software update and best cybersecurity practices

Reporter	Title	Published	Views	Family All 42
BDU FSTEC	The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert, related to incorrect processing of VXDZ files, allows a perpetrator to execute arbitrary code.	17 Jun 202000:00	–	bdu_fstec
CNVD	Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability	22 May 202000:00	–	cnvd
CNVD	Schneider Electric EcoStruxure Operator Terminal Expert Parameter Injection Vulnerability	22 May 202000:00	–	cnvd
CNVD	Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37619)	18 May 202000:00	–	cnvd
CNVD	Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37620)	18 May 202000:00	–	cnvd
CNVD	Schneider Electric EcoStruxure Operator Terminal Expert SQL Injection Vulnerability	18 May 202000:00	–	cnvd
CVE	CVE-2020-7493	16 Jun 202019:10	–	cve
CVE	CVE-2020-7494	16 Jun 202019:11	–	cve
CVE	CVE-2020-7495	16 Jun 202019:11	–	cve
CVE	CVE-2020-7496	16 Jun 202019:13	–	cve

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-142-02.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-142-02
us-cert	www.us-cert.gov/ncas/tips/ST04-014
us-cert	www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B