CVE-2020-28219

published 2020-12-11

CVE-2020-28219: A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September…

Priority P3 37 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_geo_scada_expert_2019	81.7268.1 – 81.7578.1	—
schneider-electric	ecostruxure_geo_scada_expert_2020	83.7551.1 – 83.7578.1	—

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522