PT-2020-6835 · Sprecher · Sprecon-E

Published 2020-10-19 · Updated 2021-07-21 · CVE-2020-11496

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sprecher SPRECON-E versions prior to 8.64b

Description The issue is related to insufficient input validation in the firmware of the Sprecher SPRECON-E automation module. This allows a remote attacker to potentially execute arbitrary code. The firmware lacks validation of input values on the device side, which is typically provided by the engineering software during parameterization. As a result, an attacker with access to local configuration files can insert malicious commands that are executed after compiling them to valid parameter files, transferring them to the device, and restarting the device.

Recommendations For versions prior to 8.64b, update the firmware to version 8.64b or later to resolve the issue. As a temporary workaround, consider restricting access to local configuration files and engineering data to minimize the risk of exploitation. Additionally, avoid using unvalidated input values in the device's parameterization process until the issue is resolved.

Fix

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

BDU:2023-00449

CVE-2020-11496

Affected Products

Sprecon-E

References · 4

• https://sprecher-automation.com/en/it-security · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00449 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11496 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11496 · Vendor Advisory