CVE-2020-7520

published 2020-07-23

CVE-2020-7520: A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could…

Priority P4 21 medium 4.7 CVSS 3.1

AV N AC H PR N UI R S C C L I L A N

A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	software_update_utility	<= 2.4.0	—

CVSS provenance

nvd v3.1 4.7 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:H/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601