PT-2019-5389 · Schneider Electric · Easergy T300

Publicado 2019-06-12 · Atualizado 2020-06-17 · CVE-2020-7505

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 1.5.2 and older

Description A Download of Code Without Integrity Check issue exists, which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system. The vulnerability is related to incorrect integrity checking, potentially enabling a remote attacker to inject additional code into the device's firmware and execute arbitrary code.

Recommendations For Easergy T300 versions 1.5.2 and older, update to a version newer than 1.5.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-494

Identificadores relacionados

BDU:2020-02722

CVE-2020-7505

Produtos afetados

Easergy T300

Referências · 6

• https://se.com/ww/en/download/document/SEVD-2020-161-04 · Aviso do Fabricante
• https://t.me/cvenotify/4412 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2020-7505 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-7505 · Nota de Segurança
• https://se.com/us/en/download/document/SEVD-2020-161-04 · Nota
• https://bdu.fstec.ru/vul/2020-02722 · Nota de Segurança