PT-2019-5390 · Schneider Electric · Easergy T300

Published 2019-06-12 · Updated 2021-06-11 · CVE-2020-7506

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 1.5.2 and prior

Description A vulnerability exists that could allow an attacker to expose information about files and directories in the firmware of the controller and modules. This could potentially allow an attacker to reveal protected information about files and directories, as well as make changes to files. The issue is related to the use of the usual tar archiver to pack or unpack the archive with the firmware.

Recommendations For versions 1.5.2 and prior, consider restricting access to the firmware and its components to minimize the risk of exploitation. As a temporary workaround, avoid using the tar archiver to pack or unpack the firmware archive until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-538

CWE-200

Related Identifiers

BDU:2020-02723

CVE-2020-7506

Affected Products

Easergy T300

References · 6

• https://bdu.fstec.ru/vul/2020-02723 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7506 · Security Note
• https://se.com/us/en/download/document/SEVD-2020-161-04 · Note
• https://t.me/cvenotify/4413 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-04 · Note