CVE-2020-7545

published 2020-12-01

CVE-2020-7545: A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for…

Priority P3 45 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_energy_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	power_manager	—	—
schneider-electric	power_manager	—	—
schneider-electric	power_manager	—	—
schneider-electric	powerscada_expert_with_advanced_reporting_and_dashboards	—	—
schneider-electric	powerscada_operation_with_advanced_reporting_and_dashboards	—	—

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284