Schneider T200 RTU vulnerabilities

A few CVEs published in a Schneider T300 RTU recently jogged my memory. I went back 8 years to 2012 to dig out a disclosure we made to Schneider via an operator. And there it was, similar probably identical vulnerabilities in its predecessor, the Easergy T200. As we were working via the operator,...

The vulnerability of the microprogramming software of the modular controller for automation of transformer substations—Schneider Electric Easergy T300 module SC150—is related to incorrect user authentication. This vulnerability allows a intruder to view and modify the device configuration file.

The vulnerability of the microprogramming software of the modular controller for automation of transformer substations in Schneider Electric Easergy T300 RTU devices is related to incorrect user authentication. Exploiting this vulnerability allows a malicious actor to remotely view and modify the...

CVE-2020-28217

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28217

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28216

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28218

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

CVE-2020-28215

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 firmware 2.7 and older, that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently...

CVE-2020-28216

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28218

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

CVE-2020-28215

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 firmware 2.7 and older, that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently...

Code injection

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

Authorization

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 firmware 2.7 and older, that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently...

Design/Logic Flaw

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

Code injection

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28218

The CVE-2020-28218 entry concerns Schneider Electric Easergy T300 firmware 2.7 and older, with an IMPROPER RESTRICTION OF RENDERED UI LAYERS OR FRAMES vulnerability that could let an attacker trick a user into performing unintended actions. Affected product: Easergy T300 (firmware versions 2.7 an...

CVE-2020-28218

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

CVE-2020-28217

Schneider Electric Easergy T300 firmware 2.7 and earlier is affected by CVE-2020-28217 (Missing Encryption of Sensitive Data) in the IEC60870-5-104 communication path. The NVD/NVD-derived entry indicates vulnerability to reading network traffic due to lack of encryption, with a CVSSv3 base score ...

CVE-2020-28217

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28216

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

CVE-2020-28216

CVE-2020-28216 affects Schneider Electric Easergy T300 with firmware version 2.7 and earlier. The root cause is Missing Encryption of Sensitive Data (CWE-311), allowing an attacker to read network traffic over HTTP. The vulnerability impact includes exposure of sensitive information via HTTP traf...