PT-2019-5389 · Schneider Electric · Easergy T300

Published 2019-06-12 · Updated 2020-06-17 · CVE-2020-7505

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 1.5.2 and older

Description A Download of Code Without Integrity Check issue exists, which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system. The vulnerability is related to incorrect integrity checking, potentially enabling a remote attacker to inject additional code into the device's firmware and execute arbitrary code.

Recommendations For Easergy T300 versions 1.5.2 and older, update to a version newer than 1.5.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2020-02722

CVE-2020-7505

Affected Products

Easergy T300

References · 6

• https://se.com/ww/en/download/document/SEVD-2020-161-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7505 · Security Note
• https://bdu.fstec.ru/vul/2020-02722 · Security Note
• https://t.me/cvenotify/4412 · Telegram Post
• https://se.com/us/en/download/document/SEVD-2020-161-04 · Note