CVE-2020-7546

published 2020-12-01

CVE-2020-7546: A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_energy_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	ecostruxure_power_monitoring_expert	—	—
schneider-electric	power_manager	—	—
schneider-electric	power_manager	—	—
schneider-electric	power_manager	—	—
schneider-electric	powerscada_expert_with_advanced_reporting_and_dashboards	—	—
schneider-electric	powerscada_operation_with_advanced_reporting_and_dashboards	—	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79