PT-2020-4341 · Tricon · Tricon

Reid Wightman · Published 2020-06-22 · Updated 2022-04-27 · CVE-2020-7491

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Tricon system versions 10.2.0 through 10.5.3

Description: The issue concerns a legacy debug port account in Tricon Communications Modules that is visible on the network, potentially allowing unauthorized access. This could lead to the disclosure of protected information. The estimated number of potentially affected devices worldwide is not specified.

Recommendations: For Tricon system versions 10.2.0 through 10.5.3, update to version 10.5.4 to resolve the issue. As a temporary workaround, consider restricting access to the legacy debug port account until the update to version 10.5.4 is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-04843

CVE-2020-7491

Affected Products

Tricon

References · 7

• https://se.com/ww/en/download/document/SESB-2020-105-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04843 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7491 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SESB-2020-105-01_Legacy_Triconex_Product_Vulnerabilities_Security_Bulletin_V2.1.pdf&p_Doc_Ref=SESB-2020-105-01 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SESB-2020-105-01_Legacy_Triconex_Product_Vulnerabilities_Security_Bulletin_V2.1.pdf&p_Doc_Ref=SESB-2020-105-01 · Note