PT-2019-5399 · Schneider Electric · Easergy Builder

Published 2019-08-21 · Updated 2021-12-11 · CVE-2020-7515

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easergy Builder versions 1.4.7.2 and prior

Description A vulnerability exists due to the use of a hard-coded cryptographic key stored in cleartext, which could allow an attacker to decrypt passwords. This issue is related to the storage of the cryptographic key in an unencrypted form, potentially enabling an attacker to access user passwords.

Recommendations For Easergy Builder versions 1.4.7.2 and prior, consider updating to a version that does not use hard-coded cryptographic keys in cleartext, or apply additional security measures to protect against password decryption attacks. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

BDU:2020-02732

CVE-2020-7515

Affected Products

Easergy Builder

References · 6

• https://osv.dev/vulnerability/CVE-2020-7515 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02732 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7515 · Security Note
• https://se.com/us/en/download/document/SEVD-2020-161-05 · Note
• https://t.me/cvenotify/24539 · Telegram Post