PT-2020-5051 · Schneider Electric · Easergy T300

Published 2020-03-13 · Updated 2020-12-14 · CVE-2020-28215

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 2.7 and older

Description The issue is related to incorrect user authorization in the firmware of the Easergy T300 RTU, allowing a remote attacker to view and modify the device's configuration file. This could lead to a range of problems, including information exposures, denial of service, and arbitrary code execution due to inconsistent application of access control checks.

Recommendations For versions 2.7 and older, consider restricting access to the device's configuration file until a patch is available. As a temporary workaround, apply consistent access control checks to prevent unauthorized modifications to the device's configuration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2020-05638

CVE-2020-28215

Affected Products

Easergy T300

References · 6

• https://osv.dev/vulnerability/CVE-2020-28215 · Vendor Advisory
• https://se.com/ww/en/download/document/SEVD-2020-315-06 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-28215 · Security Note
• https://t.me/cvenotify/7048 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03 · Note