CVE-2020-28219

CVE-2020-28219 affects EcoStruxure Geo SCADA Expert 2019 and 2020, with a CWE-522 vulnerability that could expose credentials to server-side users when web users are logged in to Virtual ViewX. Affected versions include EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates throu...

Schneider Electric EcoStruxure Geo SCADA Expert License Issue Vulnerability

Schneider Electric EcoStruxure Geo SCADA Expert ClearSCADA is a suite of data acquisition and monitoring software SCADA from Schneider Electric, France. EcoStruxure Geo SCADA Expert 2019 has a security vulnerability that stems from insufficient credential protection, which could result in risk...

CVE-2020-7546

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow an attacker to perform actions on behalf of the authorized user when...

CVE-2020-7545

A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow for arbitrary code execution on the server when an authorized user access an affected webpage...

CVE-2020-7545

A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow for arbitrary code execution on the server when an authorized user access an affected webpage...

CVE-2020-7547

A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow a user the ability to perform actions via the web interface at a higher privilege level...

CVE-2020-7546

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow an attacker to perform actions on behalf of the authorized user when...

Design/Logic Flaw

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow an attacker to perform actions on behalf of the authorized user when...

Improper access control

A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow a user the ability to perform actions via the web interface at a higher privilege level...

CVE-2020-7547

A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow a user the ability to perform actions via the web interface at a higher privilege level...

CVE-2020-7547

CVE-2020-7547 concerns an improper access control vulnerability in Schneider Electric EcoStruxure and SmartStruxure Power Monitoring and SCADA Software. The common description across sources states that a user can perform actions via the web interface at a higher privilege level, indicating privi...

CVE-2020-7546

Technical details (affected products/versions/root cause/remediation) are not provided in the connected documents. Monitor for updates from vendors and security advisories.

CVE-2020-7546

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow an attacker to perform actions on behalf of the authorized user when...

CVE-2020-7545

CVE-2020-7545 describes an improper access control (CWE-284) vulnerability in Schneider Electric EcoStruxure and SmartStruxure Power Monitoring and SCADA Software. An authorized user accessing an affected webpage could trigger arbitrary code execution on the server. Public references cite CVSS v3...

Schneider Electric Power Scada and EcoStruxure Power Monitoring Expert Security Vulnerabilities

Schneider Electric EcoStruxure Power Monitoring Expert and Schneider Electric Power Scada are both products of Schneider Electric, a French company. Schneider Electric EcoStruxure Power Monitoring Expert is an appliance for power distribution monitoring in IoT environments, and Schneider Electric...

Cross-Site Scripting Vulnerability in Multiple Schneider Electric Products

Schneider Electric EcoStruxure Power Monitoring Expert is a product of the French company Schneider Electric.Schneider Electric EcoStruxure Power Monitoring Schneider Electric EcoStruxure Power Monitoring Expert is a device for power distribution monitoring in IoT environments.Schneider Electric...

Schneider Electric Interactive Graphical SCADA System Buffer Overflow Vulnerability (CNVD-2020-67319)

Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. The Interactive Graphical SCADA System suffers from a buffer overflow vulnerability that stems...

Schneider Electric Interactive Graphical SCADA System Out-of-Bounds Write Vulnerability

Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. An out-of-bounds write vulnerability exists in Interactive Graphical SCADA System version...

Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution', 'Description' = %q This module exploits a series of vulnerabilities to...

Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution Exploit

This Metasploit module exploits a series of vulnerabilities to achieve unauthenticated remote code execution on the Rockwell FactoryTalk View SE SCADA product as the IIS user. The attack relies on the chaining of five separate vulnerabilities. The first vulnerability is an unauthenticated project...