PT-2019-5390 · Schneider Electric · Easergy T300
Publicado
2019-06-12
·
Atualizado
2021-06-11
·
CVE-2020-7506
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Easergy T300 versions 1.5.2 and prior
Description
A vulnerability exists that could allow an attacker to expose information about files and directories in the firmware of the controller and modules. This could potentially allow an attacker to reveal protected information about files and directories, as well as make changes to files. The issue is related to the use of the usual tar archiver to pack or unpack the archive with the firmware.
Recommendations
For versions 1.5.2 and prior, consider restricting access to the firmware and its components to minimize the risk of exploitation. As a temporary workaround, avoid using the tar archiver to pack or unpack the firmware archive until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Easergy T300