PT-2020-3663 · Schneider Electric · Somove

Published 2020-08-11 · Updated 2020-09-04 · CVE-2020-7527

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoMove versions prior to V2.8.1

Description The issue is related to incorrect default permissions in SoMove, which could lead to elevation of privilege, providing full access control to local system users over SoMove components and services when the SoMove installer script is launched. This could be exploited by an attacker to gain elevated privileges.

Recommendations For SoMove versions prior to V2.8.1, update to a version that fixes the incorrect default permission issue to prevent elevation of privilege. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2020-04011

CVE-2020-7527

Affected Products

Somove

References · 6

• https://osv.dev/vulnerability/CVE-2020-7527 · Vendor Advisory
• https://se.com/ww/en/download/document/SEVD-2020-224-07 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7527 · Security Note
• https://bdu.fstec.ru/vul/2020-04011 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-224-07_SoMove_Security_Notification.pdf&p_Doc_Ref=SEVD-2020-224-07 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-224-07_SoMove_Security_Notification.pdf&p_Doc_Ref=SEVD-2020-224-07 · Note