CVE-2020-7494
published 2020-06-16CVE-2020-7494: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1…
PriorityP337high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.35%
68.2th percentile
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | ecostruxure_operator_terminal_expert | <= 3.0 | — |
| schneider-electric | ecostruxure_operator_terminal_expert | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric EcoStruxure Operator Terminal Expert
cisa_ics·2020-05-21·CVSS 7.8
[HIGH] Schneider Electric EcoStruxure Operator Terminal Expert
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric EcoStruxure Operator Terminal Expert
Last RevisedMay 21, 2020
Alert CodeICSA-20-142-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.6
- ATTENTION: Low skill level to exploit/public exploits are available
- Vendor: Schneider Electric
- Equipment: EcoStruxure Operator Terminal Expert
- Vulnerabilities: SQL Injection, Path Traversal, Argument Injection
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow unauthorized write access or remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports the
GHSA
GHSA-3f4q-8cmp-6284: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert
ghsa_unreviewed·2022-05-24
CVE-2020-7494 [MEDIUM] GHSA-3f4q-8cmp-6284: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-06-16
Published