{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Andover Continuum controller (NetController 1 (NC1) = mod\u00e8le CX9900, NetController 2 (NC2) = mod\u00e8le CX9680, ACX2 = mod\u00e8les ACX5720 et ACX5740, s\u00e9ries CX9200, s\u00e9ries CX9400, CX9924, CX9702, s\u00e9ries BCX4040, s\u00e9ries BCX9640) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine SCADA Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Clipsal (EER72600) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Power Manager versions 1.1, 1.2 et 1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV630/650/660/680/6A0/6B0 Altivar Process Drives 2.6IE31 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 CPUs (BMX P34x) micologiciel versions ant\u00e9rieures \u00e0 3.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AOS 6.8.8 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Energy Expert version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine Expert (pr\u00e9c\u00e9demment SoMachine et SoMachine Motion) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS et Symmetra UPS Network Management Card 1 (NMC1) SmartSlot (mod\u00e8les AP9617 (fin de support Nov 2011), AP9619 (fin de support Sep 2012), AP9618 (fin de support Jan 2017), Audio/Video Network Management Enabled products (S20BLK, G50NETB2, G50NETB-20A2)) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XGCS850C201 OsiSense RFID compact smart antenna toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV6000 Medium Voltage AltivarProcess Drives 1.1IE02 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ZBRCETH Modbus TCP communication module for ZBRN1 Harmony Hub 02.03 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink EL B 1.2.1 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link C et Link HD toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (2G Metered/Switched Rack PDUs with embedded NMC2, AP84XX, AP86XX, AP88XX, AP89XX)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Ethernet Interface pour ComPact, PowerPact, et disjoncteurs MasterPact toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium processors avec Ethernet COPRO int\u00e9gr\u00e9 (TSXP574634, TSXP575634, TSXP576634) versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TM3BC bus coupler module EIP, SL et CANOpen toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Co-processors ref. 140CPU6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink SI D et SI B 002.004.002 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink IP, Acti9 Smartlink EL B et EL D, Acti9 Smartlink SI B et SI D toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Ethernet communication modules ref.140NOE et 140NOC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3) SmartSlot (mod\u00e8les AP9640/AP9640J, AP9641/AP9641J) AOS 1.3.0.6 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Link 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 32 RTUsAll versions 2.24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Centrale de mesure PowerLogic PM5000 series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV340E Altivar Machine Drives 3.1IE23 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module versions 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ACE850 Sepam communication interface toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TeSys T LTMR08EBD Motor Controller toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Gateway Connector par Elko (EKO01827) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Metered/Switched Rack PDUs with embedded NMC1, AP78XX, AP79XX) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link / Link HD 001.008.007 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Momentum Ethernet MDI",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400, E+PLC100 et E+PLC_Setup toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "VW3A3720, VW3A3721 Altivar ProcessCommunication Modules 1.15IE18 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Building SmartX IP MP et IP RP Controllers toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 Communication Ethernet modules BMX NOE 0100 (H) versions ant\u00e9rieures \u00e0 3.3, BMX NOE 0110 (H) versions ant\u00e9rieures \u00e0 6.5, BMX NOC 0401 versions ant\u00e9rieures \u00e0 2.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power Monitoring Expert versions 7.x, 8.x et 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "eIFE Ethernet Interface pour disjoncteurs MasterPact MTZ drawout toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M241 et M251 Logic Controller micrologiciel versions ant\u00e9rieures \u00e0 5.0.8.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EGX150/Link150 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum processors avec Ethernet COPRO int\u00e9gr\u00e9 140CPU65xxxxx versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XUPH001 OsSense communication module toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV930/950/960/980/9A0/9B0 Altivar Process Drives 3.1IE24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic EGX300 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum communication modules 140NOE771x1 versions ant\u00e9rieures \u00e0 7.1, 140NOC78x00 versions ant\u00e9rieures \u00e0 1.74, 140NOC77101 versions ant\u00e9rieures \u00e0 1.08",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Ethernet communication modules ref. TSXETY",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Battery Management System, AP9921X, Rack Automatic Transfer Switches, AP77XX, AP9320, AP9340, AP9361, NetBotz NBRK0200, NetworkAir, InRow) AOS 3.9.2 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Schneider Electric (EER31800) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Co-processors ref. TSXP et TSXH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (Battery Manager, AP9922, Rack Automatic Transfer Switches, AP44XX, NetBotz NBRK0250) AOS 6.8.8 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium communication modules TSXETY4103 versions ant\u00e9rieures \u00e0 6.2, TSXETY5103 versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 Ethernet communication Modules ref. BMXNOC, BMXNOE, BMXNOR",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU ref. BMXP34",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-7547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7547"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-7548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7548"
    },
    {
      "name": "CVE-2020-7545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7545"
    },
    {
      "name": "CVE-2017-6028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-7546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7546"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-7533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7533"
    },
    {
      "name": "CVE-2020-11898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
    },
    {
      "name": "CVE-2020-11896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-643",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service, un\ncontournement de la politique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-02 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-02/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-075-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2017-075-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-04 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-01/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-175-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-175-01/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Andover Continuum controller (NetController 1 (NC1) = mod\u00e8le CX9900, NetController 2 (NC2) = mod\u00e8le CX9680, ACX2 = mod\u00e8les ACX5720 et ACX5740, s\u00e9ries CX9200, s\u00e9ries CX9400, CX9924, CX9702, s\u00e9ries BCX4040, s\u00e9ries BCX9640) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine SCADA Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Clipsal (EER72600) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Power Manager versions 1.1, 1.2 et 1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV630/650/660/680/6A0/6B0 Altivar Process Drives 2.6IE31 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 CPUs (BMX P34x) micologiciel versions ant\u00e9rieures \u00e0 3.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AOS 6.8.8 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Energy Expert version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine Expert (pr\u00e9c\u00e9demment SoMachine et SoMachine Motion) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS et Symmetra UPS Network Management Card 1 (NMC1) SmartSlot (mod\u00e8les AP9617 (fin de support Nov 2011), AP9619 (fin de support Sep 2012), AP9618 (fin de support Jan 2017), Audio/Video Network Management Enabled products (S20BLK, G50NETB2, G50NETB-20A2)) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XGCS850C201 OsiSense RFID compact smart antenna toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV6000 Medium Voltage AltivarProcess Drives 1.1IE02 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ZBRCETH Modbus TCP communication module for ZBRN1 Harmony Hub 02.03 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink EL B 1.2.1 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link C et Link HD toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (2G Metered/Switched Rack PDUs with embedded NMC2, AP84XX, AP86XX, AP88XX, AP89XX)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Ethernet Interface pour ComPact, PowerPact, et disjoncteurs MasterPact toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium processors avec Ethernet COPRO int\u00e9gr\u00e9 (TSXP574634, TSXP575634, TSXP576634) versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TM3BC bus coupler module EIP, SL et CANOpen toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Co-processors ref. 140CPU6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink SI D et SI B 002.004.002 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink IP, Acti9 Smartlink EL B et EL D, Acti9 Smartlink SI B et SI D toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Ethernet communication modules ref.140NOE et 140NOC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3) SmartSlot (mod\u00e8les AP9640/AP9640J, AP9641/AP9641J) AOS 1.3.0.6 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Link 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 32 RTUsAll versions 2.24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Centrale de mesure PowerLogic PM5000 series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV340E Altivar Machine Drives 3.1IE23 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module versions 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ACE850 Sepam communication interface toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TeSys T LTMR08EBD Motor Controller toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Gateway Connector par Elko (EKO01827) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Metered/Switched Rack PDUs with embedded NMC1, AP78XX, AP79XX) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link / Link HD 001.008.007 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Momentum Ethernet MDI",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400, E+PLC100 et E+PLC_Setup toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "VW3A3720, VW3A3721 Altivar ProcessCommunication Modules 1.15IE18 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Building SmartX IP MP et IP RP Controllers toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 Communication Ethernet modules BMX NOE 0100 (H) versions ant\u00e9rieures \u00e0 3.3, BMX NOE 0110 (H) versions ant\u00e9rieures \u00e0 6.5, BMX NOC 0401 versions ant\u00e9rieures \u00e0 2.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power Monitoring Expert versions 7.x, 8.x et 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "eIFE Ethernet Interface pour disjoncteurs MasterPact MTZ drawout toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M241 et M251 Logic Controller micrologiciel versions ant\u00e9rieures \u00e0 5.0.8.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EGX150/Link150 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum processors avec Ethernet COPRO int\u00e9gr\u00e9 140CPU65xxxxx versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XUPH001 OsSense communication module toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV930/950/960/980/9A0/9B0 Altivar Process Drives 3.1IE24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic EGX300 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum communication modules 140NOE771x1 versions ant\u00e9rieures \u00e0 7.1, 140NOC78x00 versions ant\u00e9rieures \u00e0 1.74, 140NOC77101 versions ant\u00e9rieures \u00e0 1.08",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Ethernet communication modules ref. TSXETY",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Battery Management System, AP9921X, Rack Automatic Transfer Switches, AP77XX, AP9320, AP9340, AP9361, NetBotz NBRK0200, NetworkAir, InRow) AOS 3.9.2 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Schneider Electric (EER31800) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Co-processors ref. TSXP et TSXH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (Battery Manager, AP9922, Rack Automatic Transfer Switches, AP44XX, NetBotz NBRK0250) AOS 6.8.8 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium communication modules TSXETY4103 versions ant\u00e9rieures \u00e0 6.2, TSXETY5103 versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 Ethernet communication Modules ref. BMXNOC, BMXNOE, BMXNOR",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU ref. BMXP34",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-7547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7547"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-7548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7548"
    },
    {
      "name": "CVE-2020-7545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7545"
    },
    {
      "name": "CVE-2017-6028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-7546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7546"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-7533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7533"
    },
    {
      "name": "CVE-2020-11898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
    },
    {
      "name": "CVE-2020-11896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-643",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service, un\ncontournement de la politique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-02 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-02/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-075-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2017-075-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-04 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-01/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-175-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-175-01/"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2020-7545",
    "description": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.",
    "id": "GSD-2020-7545"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-7545"
      ],
      "details": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.",
      "id": "GSD-2020-7545",
      "modified": "2023-12-13T01:21:51.608612Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cybersecurity@schneider-electric.com",
        "ID": "CVE-2020-7545",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information)"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-284:Improper Access Control"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
            "refsource": "MISC",
            "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@schneider-electric.com",
          "ID": "CVE-2020-7545"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-09-03T03:46Z",
      "publishedDate": "2020-12-01T15:15Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDF7DFC6-6F41-491B-A703-6AB0143FE5B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6819EA7A-C803-480F-98DF-44DA144FE488",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "66E928C4-87C8-4BD6-9131-B7D558330CBA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BEB4F4B-0B22-47CA-B173-C06C1A925348",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FC0093C-00CE-43A8-80EC-0509992E637B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE9A1DF0-42B8-4123-8276-1D4BED156034",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "54A54A8D-40F5-4E75-A524-B81E487DB274",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CC2CF9D-8D0C-4FD3-94A2-34A63E297B81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC8F406C-868A-443C-8842-6CFFFF17C236",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage."
    },
    {
      "lang": "es",
      "value": "Una CWE-284: Se presenta una vulnerabilidad Control de Acceso Inapropiado en el Software EcoStruxure\u00aa y SmartStruxure\u00aa Power Monitoring and SCADA (v\u00e9ase la notificaci\u00f3n de seguridad para la informaci\u00f3n de la versi\u00f3n) que podr\u00eda permitir una ejecuci\u00f3n de c\u00f3digo arbitraria en el servidor cuando un usuario autorizado accede a una p\u00e1gina web afectada"
    }
  ],
  "id": "CVE-2020-7545",
  "lastModified": "2024-11-21T05:37:21.233",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-12-01T15:15:12.297",
  "references": [
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "cybersecurity@se.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-7545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-01T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.",
  "id": "GHSA-x2vm-m96w-rq2c",
  "modified": "2022-09-04T00:00:23Z",
  "published": "2022-05-24T22:33:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7545"
    },
    {
      "type": "WEB",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
        "title": "General Security Recommendations"
      },
      {
        "category": "general",
        "text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
        "title": "For More Information"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
        "title": "LEGAL DISCLAIMER"
      },
      {
        "category": "general",
        "text": "At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.\n\nWe provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.\n\nWe are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.\n\nwww.se.com ",
        "title": "About Schneider Electric"
      },
      {
        "category": "summary",
        "text": "Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure\u2122 and SmartStruxure\u2122 \r\nPower Monitoring \u0026 SCADA Software. \r\nFailure to apply the mitigation provided below may risk remote code execution, which could \r\nresult in an attacker gaining root level access to the underlying operating system on the \r\nimpacted server. ",
        "title": "Overview"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cpcert@se.com",
      "name": "Schneider Electric CPCERT",
      "namespace": "https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
    },
    "references": [
      {
        "category": "self",
        "summary": "EcoStruxure\u2122 and SmartStruxure\u2122  - SEVD-2020-287-04 PDF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-287-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-287-04_EcoStruxure_and_SmartStruxure_Power_Monitoring_and_SCADA%20Software_Security_Notification.pdf"
      },
      {
        "category": "self",
        "summary": "EcoStruxure\u2122 and SmartStruxure\u2122  - SEVD-2020-287-04 CSAF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-287-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2020-287-04.json"
      },
      {
        "category": "external",
        "summary": "Recommended Cybersecurity Best Practices",
        "url": "https://www.se.com/us/en/download/document/7EN52-0390/"
      }
    ],
    "title": "EcoStruxure\u2122 and SmartStruxure\u2122 Power Monitoring and SCADA Software",
    "tracking": {
      "current_release_date": "2020-10-13T00:00:00.000Z",
      "generator": {
        "date": "2020-10-13T00:00:00.000Z",
        "engine": {
          "name": "Schneider Electric CSAF Generator",
          "version": "1.2"
        }
      },
      "id": "SEVD-2020-287-04",
      "initial_release_date": "2020-10-13T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2020-10-13T00:00:00.000Z",
          "number": "1.0.0",
          "summary": "Original Release"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.0",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power Monitoring Expert version 9.0",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power Monitoring Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.x",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power Monitoring Expert version 8.x",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power Monitoring Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.x",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power Monitoring Expert version 7.x",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power Monitoring Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Energy Expert version 2.0",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Energy Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.1",
                "product": {
                  "name": "Schneider Electric Power Manager version 1.1",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Power Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.2",
                "product": {
                  "name": "Schneider Electric Power Manager version 1.2",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Power Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.3",
                "product": {
                  "name": "Schneider Electric Power Manager version 1.3",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Power Manager"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.x",
                "product": {
                  "name": "Schneider Electric StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module version 8.x",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.0",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power SCADA Operation with Advanced Reporting and Dashboards Module"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2020",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power Monitoring Expert Version 2020",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power Monitoring Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Energy Expert version 3.0",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Energy Expert"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2020",
                "product": {
                  "name": "Schneider Electric EcoStruxure\u2122 Power SCADA Operations with Advanced Reporting and Dashboard Module Products version 2020",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure\u2122 Power SCADA Operations with Advanced Reporting and Dashboard Module Products"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Michiel Evers",
            "Niels Pirotte"
          ]
        }
      ],
      "cve": "CVE-2020-7545",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "A CWE-284:Improper Access Control vulnerability exists that could allow for arbitrary code \r\nexecution on the server when an authorized user access an affected webpage.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "10",
          "11",
          "12"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower Monitoring Expert Version 2020, contact your \r\nSchneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "1",
            "2",
            "3"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nEnergy Expert V3.0, contact your Schneider Electric \r\nrepresentative for details on how to upgrade your system",
          "product_ids": [
            "4"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system",
          "product_ids": [
            "5",
            "6",
            "7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower SCADA Operations with Advanced Reporting \r\nand Dashboard Module Products version 2020., contact\r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "9"
          ],
          "restart_required": {
            "category": "none"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.4,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "temporalScore": 8.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-7545 "
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Michiel Evers"
          ]
        }
      ],
      "cve": "CVE-2020-7546",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability\r\nexists that could allow an attacker to perform actions on behalf of the authorized \r\nuser when accessing an affected webpage.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "10",
          "11",
          "12"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower Monitoring Expert Version 2020, contact your \r\nSchneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "1",
            "2",
            "3"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nEnergy Expert V3.0, contact your Schneider Electric \r\nrepresentative for details on how to upgrade your system",
          "product_ids": [
            "4"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system",
          "product_ids": [
            "5",
            "6",
            "7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower SCADA Operations with Advanced Reporting \r\nand Dashboard Module Products version 2020., contact\r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "9"
          ],
          "restart_required": {
            "category": "none"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.4,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-7546 "
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Michiel Evers"
          ]
        }
      ],
      "cve": "CVE-2020-7547",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "A CWE-284: Improper Access Control vulnerability exists that could allow a user the ability to \r\nperform actions via the web interface at a higher privilege level.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "10",
          "11",
          "12"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower Monitoring Expert Version 2020, contact your \r\nSchneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "1",
            "2",
            "3"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nEnergy Expert V3.0, contact your Schneider Electric \r\nrepresentative for details on how to upgrade your system",
          "product_ids": [
            "4"
          ],
          "restart_required": {
            "category": "none"
          }
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system",
          "product_ids": [
            "5",
            "6",
            "7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "mitigation",
          "details": "Contact customer support for mitigation instructions, or \r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "8"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/us/en/work/support/"
        },
        {
          "category": "vendor_fix",
          "details": "These vulnerabilities have been fixed in EcoStruxure\u2122 \r\nPower SCADA Operations with Advanced Reporting \r\nand Dashboard Module Products version 2020., contact\r\nyour Schneider Electric representative for details on how to \r\nupgrade your system.",
          "product_ids": [
            "9"
          ],
          "restart_required": {
            "category": "none"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-7547"
    }
  ]
}