CVE-2020-28215

Published: Dec 11, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently.

Affected (1)

Products: Schneider Electric: Easergy T300 Firmware

Schneider Electric

1 product

Easergy T300 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Easergy T300 Firmware	Up to 2.7

Running on/with	Platform Versions
Schneider Electric Easergy T300	All versions

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03

Source: cybersecurity@se.com

Third Party Advisory

https://www.se.com/ww/en/download/document/SEVD-2020-315-06/

Source: cybersecurity@se.com

Vendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.se.com/ww/en/download/document/SEVD-2020-315-06/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.