PT-2020-2730 · Schneider Electric · Ecostruxure Operator Terminal Expert

Published 2020-05-13 · Updated 2020-06-17 · CVE-2020-7493

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior

Description The issue is related to improper handling of VXDZ files and a SQL Injection vulnerability, which could allow an attacker to execute arbitrary code using a specially crafted file or web page. This may lead to malicious code execution when opening a project file.

Recommendations For EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior, update to a version that addresses the improper handling of VXDZ files and the SQL Injection vulnerability to prevent malicious code execution. As a temporary workaround, consider restricting access to VXDZ files and project files to minimize the risk of exploitation.

Fix

SQL injection

OS Command Injection

Weakness Enumeration

CWE-89

CWE-78

Related Identifiers

BDU:2020-02806

CVE-2020-7493

ZDI-20-658

Affected Products

Ecostruxure Operator Terminal Expert

References · 5

• https://zerodayinitiative.com/advisories/ZDI-20-658 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7493 · Vendor Advisory
• https://se.com/ww/en/download/document/SEVD-2020-133-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7493 · Security Note
• https://bdu.fstec.ru/vul/2020-02806 · Security Note