PT-2020-6374 · Schneider Electric · Easergy T300

Evgeniy Druzhinin + 1 · Published 2020-11-10 · Updated 2020-12-14 · CVE-2020-28218

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 2.7 and older

Description The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to perform arbitrary actions. This is due to improper restriction of rendered UI layers or frames, allowing an attacker to trick a user into initiating an unintended action.

Recommendations For versions 2.7 and older, update the firmware to a version newer than 2.7 to resolve the issue. As a temporary workaround, consider restricting access to the user interface to minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2021-04329

CVE-2020-28218

Affected Products

Easergy T300

References · 8

• https://bdu.fstec.ru/vul/2021-04329 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-28218 · Security Note
• https://se.com/ww/en/download/document/SEVD-2020-315-06 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28218 · Vendor Advisory
• https://t.me/cvenotify/7049 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-315-06_Easergy_T300_Security_Notification_V2.0.pdf&p_Doc_Ref=SEVD-2020-315-06 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-315-06_Easergy_T300_Security_Notification_V2.0.pdf&p_Doc_Ref=SEVD-2020-315-06 · Note