Vulnerability-Lookup

SEVD-2020-175-01

Vulnerability from csaf_se - Published: 2020-06-23 16:00 - Updated: 2022-08-08 13:57

Summary

Treck TCP/IP Vulnerabilities (Ripple20)

Notes

General Security Recommendations

We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the “Program” mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

For More Information

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

LEGAL DISCLAIMER

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

About Schneider Electric

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment. We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries. We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values. www.se.com

Overview

Schneider Electric is aware of multiple vulnerabilities affecting Treck Inc.’s embedded TCP/IP stack, collectively known as Ripple20, which Treck disclosed publicly on June 16. The vulnerabilities range in severity and therefore have varying levels of risk. Schneider Electric continues to assess how the newly disclosed vulnerabilities affect its offers. The company will continue to update this notification as additional offer-specific information becomes available. Customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities. Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the remediation and general security recommendations below. For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center. August 2022 Update: Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2).

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
        "title": "General Security Recommendations"
      },
      {
        "category": "general",
        "text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
        "title": "For More Information"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
        "title": "LEGAL DISCLAIMER"
      },
      {
        "category": "general",
        "text": "At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.\n\nWe provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.\n\nWe are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.\n\nwww.se.com ",
        "title": "About Schneider Electric"
      },
      {
        "category": "summary",
        "text": "Schneider Electric is aware of multiple vulnerabilities affecting Treck Inc.\u2019s embedded TCP/IP stack, collectively known as Ripple20, which Treck disclosed publicly on June 16. The vulnerabilities range in severity and therefore have varying levels of risk.\r\nSchneider Electric continues to assess how the newly disclosed vulnerabilities affect its offers. The company will continue to update this notification as additional offer-specific information becomes available.\r\nCustomers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities. Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the remediation and general security recommendations below.\r\nFor additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric\u2019s Customer Care Center.\r\nAugust 2022 Update: Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2).",
        "title": "Overview"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cybersecurity@se.com",
      "name": "Schneider Electric CPCERT",
      "namespace": "https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
    },
    "references": [
      {
        "category": "self",
        "summary": "Treck TCP/IP Vulnerabilities (Ripple20) - SEVD-2020-175-01 PDF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-175-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-175-01_Treck_Vulnerabilities_Ripple20_Security_Notification_V2.18.pdf"
      },
      {
        "category": "self",
        "summary": "Treck TCP/IP Vulnerabilities (Ripple20) - SEVD-2020-175-01 CSAF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-175-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2020-175-01.json"
      },
      {
        "category": "external",
        "summary": "Recommended Cybersecurity Best Practices",
        "url": "https://www.se.com/us/en/download/document/7EN52-0390/"
      }
    ],
    "title": "Treck TCP/IP Vulnerabilities (Ripple20)",
    "tracking": {
      "current_release_date": "2022-08-08T13:57:08.970Z",
      "generator": {
        "date": "2022-08-10T14:27:48.879Z",
        "engine": {
          "name": "Schneider Electric CSAF Generator",
          "version": "1.1"
        }
      },
      "id": "sevd-2020-175-01",
      "initial_release_date": "2020-06-23T16:00:00.000Z",
      "revision_history": [
        {
          "date": "2020-06-23T16:00:00.000Z",
          "number": "1.0.0",
          "summary": "Original Release"
        },
        {
          "date": "2020-06-24T16:00:00.000Z",
          "number": "1.1.0",
          "summary": "- Added link to related SEVD-2020-174-01 Security Notification document for Network Management Card (NMC) offers (pages 4-5)\n- Minor formatting changes"
        },
        {
          "date": "2020-06-27T16:00:00.000Z",
          "number": "1.2.0",
          "summary": "- Enhanced Andover Continuum affected product information (page 3)\n- Minor formatting changes"
        },
        {
          "date": "2020-07-02T16:00:00.000Z",
          "number": "1.3.0",
          "summary": "Added Acti9 Smartlink EL B to affected product list (page 2)"
        },
        {
          "date": "2020-07-14T16:00:00.000Z",
          "number": "1.4.0",
          "summary": "Removed Smartlink ELEC (duplicate reference for Acti9 Smartlink EL B) from the affected product list (page 3)"
        },
        {
          "date": "2020-07-29T16:00:00.000Z",
          "number": "2.0.0",
          "summary": "- Added Wiser Energy IP module by Schneider Electric, Wiser Energy IP module by Schneider Electric , and Gateway Connector by Elko to affected products list (page 5)\n- Added XUPH001 OsSense communication module and XGCS850C201 OsiSense RFID compact smart antenna to affected products list (page 2)\n- Removed PowerLogic EGX100, ECI850 Sepam IEC 61850 Server, and PowerLogic G3200 Modbus to IEC 61850 Gateway from affected products list. (page 3)"
        },
        {
          "date": "2020-08-05T16:00:00.000Z",
          "number": "2.1.0",
          "summary": "Added remediation for Uninterruptible Power Supply (UPS) using NMC2 (page 2)"
        },
        {
          "date": "2020-08-06T16:00:00.000Z",
          "number": "2.2.0",
          "summary": "Corrected affected version(s) and enhanced remediation/mitigation version details for Uninterruptible Power Supply (UPS) using NMC2 (page 2)"
        },
        {
          "date": "2020-09-01T16:00:00.000Z",
          "number": "2.3.0",
          "summary": "Added remediation for Cooling Products using NMC2 and partial remediations for ATM3BC bus coupler module \u2013 EIP, TM3BC bus coupler module \u2013 SL, and TM3BC bus coupler module \u2013 CANOpen (page 2-3)"
        },
        {
          "date": "2020-10-13T16:00:00.000Z",
          "number": "2.4.0",
          "summary": "Added remediation guidance for VW3A3310 Altivar 61/71 Modbus TCP, VW3A3310D Altivar 61/71 Ethernet daisy chain, VW3A3316 Altivar 61/71 Ethernet IP, and VW3A3320 Altivar 61/71 Ethernet IP RSTP options. (page 2-3)"
        },
        {
          "date": "2020-10-23T16:00:00.000Z",
          "number": "2.5.0",
          "summary": "- Added remediation for EGX150/Link150 Ethernet Gateway , Acti9 PowerTag Link / HD , Acti9 Smartlink SI D , and Acti9 Smartlink SI B\n- All APC Network Management Card related impact and remediation information has been moved to the existing Security Notification SEVD-2020-174-01 for increased clarity.\n- Added PowerLogic EGX100 to affected products list\n\u2022 Note: Based on information received earlier this year, Schneider Electric originally determined that its PowerLogic EGX100 was not affected by vulnerabilities in Treck Inc.\u2019s embedded TCP/IP stack. After receiving additional information and analysis from Treck, Inc and JSOF, Schneider Electric has determined this offer is impacted. Users of this product are encouraged to apply the recommended mitigation actions immediately to minimize the risks associated with vulnerabilities in Treck Inc.\u2019s embedded TCP/IP stack."
        },
        {
          "date": "2020-11-10T17:00:00.000Z",
          "number": "2.6.0",
          "summary": "Added remediations for eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers, IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers, and IFE Gateway (page 4)"
        },
        {
          "date": "2020-12-08T17:00:00.000Z",
          "number": "2.7.0",
          "summary": "Added remediations for SCADAPack 32 RTU, XUPH001 OsSense communication module, XGCS850C201 OsiSense RFID compact smart antenna, ATV340E Altivar Machine Drives, ATV630/650/660/680/6A0/6B0 Altivar Process Drives, ATV930/950/960/980/9A0/9B0 Altivar Process Drives, VW3A3720, VW3A3721 Altivar Process Communication Modules, ACE850 Sepam communication interface, PowerLogic EGX300 Ethernet Gateway, PowerLogic EGX100 Ethernet Gateway, Acti9 Smartlink IP (page 2, 4-5)"
        },
        {
          "date": "2020-12-08T17:00:00.000Z",
          "number": "2.8.0",
          "summary": "Added remediations for EcoStruxure Building SmartX IP RP"
        },
        {
          "date": "2021-01-12T17:00:00.000Z",
          "number": "2.9.0",
          "summary": "Added remediations for PowerLogic PM5000 Series Power Meters in Download Links section (page 11)"
        },
        {
          "date": "2021-03-09T17:00:00.000Z",
          "number": "2.10.0",
          "summary": "Fixed version for EcoStruxure Building SmartX IP MP Controllers and EcoStruxure Building SmartX IP RP Controllers corrected to 3.02.02 (previously listed as 3.02.01) (page 6)"
        },
        {
          "date": "2021-04-12T16:00:00.000Z",
          "number": "2.11.0",
          "summary": "Added remediation for Acti9 PowerTag Link C (page 5)"
        },
        {
          "date": "2021-05-11T16:00:00.000Z",
          "number": "2.12.0",
          "summary": "Added remediation for ZBRCETH Modbus TCP communication\nmodule for ZBRN1 Harmony Hub (page 4)"
        },
        {
          "date": "2021-07-13T16:00:00.000Z",
          "number": "2.13.0",
          "summary": "Added remediation for TM3 bus coupler modules \u2013 EIP/SL/CANOpen and Acti9 Smartlink EL B A9XELC08 (page 2-3, 5)"
        },
        {
          "date": "2021-08-10T16:00:00.000Z",
          "number": "2.14.0",
          "summary": "Corrected download links for TM3 bus coupler modules \u2013 EIP/SL/CANOpen (page 2-3)"
        },
        {
          "date": "2021-11-09T17:00:00.000Z",
          "number": "2.15.0",
          "summary": "Added remediation for TeSys T LTMRxxEyy Motor Controllers (page 8)"
        },
        {
          "date": "2021-11-18T17:00:00.000Z",
          "number": "2.16.0",
          "summary": "Added remediation for Wiser Energy IP module by Schneider Electric (EER31800), Wiser Energy IP module by Clipsal (EER72600), and Gateway Connector by Elko (EKO01827) (page 6-7)"
        },
        {
          "date": "2022-03-08T17:00:00.000Z",
          "number": "2.17.0",
          "summary": "Added final mitigations for Andover Continuum Controllers (page 6)"
        },
        {
          "date": "2022-08-09T16:00:00.000Z",
          "number": "2.18.0",
          "summary": "Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2)"
        }
      ],
      "status": "final",
      "version": "2.18.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.2IE25",
                "product": {
                  "name": "Schneider Electric ATV340E Altivar Machine Drives prior to 3.2IE25",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "3.2IE25",
                "product": {
                  "name": "Schneider Electric ATV340E Altivar Machine Drives V3.2IE25",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "ATV340E Altivar Machine Drives"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.3IE33",
                "product": {
                  "name": "Schneider Electric ATV630/650/660/680/6A0/6B0 Altivar Process Drives prior to 3.3IE33",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version",
                "name": "3.3IE26",
                "product": {
                  "name": "Schneider Electric ATV630/650/660/680/6A0/6B0 Altivar Process Drives V3.3IE26",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "ATV630/650/660/680/6A0/6B0 Altivar Process Drives"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.3IE26",
                "product": {
                  "name": "Schneider Electric ATV930/950/960/980/9A0/9B0 Altivar Process Drives prior to V3.3IE26",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "V3.3IE26",
                "product": {
                  "name": "Schneider Electric ATV930/950/960/980/9A0/9B0 Altivar Process Drives V3.3IE26",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "ATV930/950/960/980/9A0/9B0 Altivar Process Drives"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.6IE01",
                "product": {
                  "name": "Schneider Electric ATV6000 Medium Voltage Altivar Process Drives prior to V1.6IE01",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=3.3IE26",
                "product": {
                  "name": "Schneider Electric ATV6000 Medium Voltage Altivar Process Drives Version 3.3IE26 and later",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "ATV6000 Medium Voltage Altivar Process Drives"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.25",
                "product": {
                  "name": "Schneider Electric SCADAPack 32 RTU prior to V2.25",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=2.25",
                "product": {
                  "name": "Schneider Electric SCADAPack 32 RTU version 2.25 and later",
                  "product_id": "CSAFPID-0011"
                }
              }
            ],
            "category": "product_name",
            "name": "SCADAPack 32 RTU"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.2.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module \u2013 EIP prior to V2.2.1.1",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version",
                "name": "2.2.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module \u2013 EIP V2.2.1.1",
                  "product_id": "CSAFPID-0013"
                }
              }
            ],
            "category": "product_name",
            "name": "TM3BC bus coupler module \u2013 EIP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.1.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module - SL prior to V2.1.1.1",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version",
                "name": "2.1.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module - SL V2.1.1.1",
                  "product_id": "CSAFPID-0015"
                }
              }
            ],
            "category": "product_name",
            "name": "TM3BC bus coupler module - SL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.1.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module - CANOpen prior to V2.1.1.1",
                  "product_id": "CSAFPID-0016"
                }
              },
              {
                "category": "product_version",
                "name": "2.1.1.1",
                "product": {
                  "name": "Schneider Electric TM3BC bus coupler module - CANOpen V2.1.1.1",
                  "product_id": "CSAFPID-0017"
                }
              }
            ],
            "category": "product_name",
            "name": "TM3BC bus coupler module - CANOpen"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=2.1IE09",
                "product": {
                  "name": "Schneider Electric VW3A3310 Altivar 61/71 Modbus TCP option version 2.1IE09 and prior",
                  "product_id": "CSAFPID-0018"
                }
              }
            ],
            "category": "product_name",
            "name": "VW3A3310 Altivar 61/71 Modbus TCP option"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=3.0IE11",
                "product": {
                  "name": "Schneider Electric VW3A3310D Altivar 61/71 Ethernet daisy chain option Version 3.0IE11 and prior",
                  "product_id": "CSAFPID-0019"
                }
              }
            ],
            "category": "product_name",
            "name": "VW3A3310D Altivar 61/71 Ethernet daisy chain option"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.2IE14",
                "product": {
                  "name": "Schneider Electric VW3A3320 Altivar 61/71 Ethernet IP option Version V1.2IE14 and prior",
                  "product_id": "CSAFPID-0052"
                }
              }
            ],
            "category": "product_name",
            "name": "VW3A3320 Altivar 61/71 Ethernet IP option"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.1IE19",
                "product": {
                  "name": "Schneider Electric VW3A3320 Altivar 61/71 Ethernet IP RSTP option version V1.1IE19 and prior",
                  "product_id": "CSAFPID-0020"
                }
              }
            ],
            "category": "product_name",
            "name": "VW3A3320 Altivar 61/71 Ethernet IP RSTP option"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric XUPH001 OsSense communication module all versions",
                  "product_id": "CSAFPID-0021"
                }
              }
            ],
            "category": "product_name",
            "name": "XUPH001 OsSense communication module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric XGCS850C201 OsiSense RFID compact smart antenna all versions",
                  "product_id": "CSAFPID-0022"
                }
              }
            ],
            "category": "product_name",
            "name": "XGCS850C201 OsiSense RFID compact smart antenna"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.15IE25",
                "product": {
                  "name": "Schneider Electric VW3A3720, VW3A3721 Altivar Process Communication Modules All Versions prior to V1.15IE25",
                  "product_id": "CSAFPID-0023"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=V1.15IE25",
                "product": {
                  "name": "Schneider Electric VW3A3720, VW3A3721 Altivar Process Communication Modules version V1.15IE25 and prior",
                  "product_id": "CSAFPID-0024"
                }
              }
            ],
            "category": "product_name",
            "name": "VW3A3720, VW3A3721 Altivar Process Communication Modules"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=SV:02.04|\u003c= PV:02|\u003c=RL:02",
                "product": {
                  "name": "Schneider Electric ZBRCETH Modbus TCP communication \u003c=SV:02.04 | \u003c= PV:02 | \u003c=RL:02 ",
                  "product_id": "CSAFPID-0025"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=SV:02.05|\u003e=PV:03|\u003e=RL:03",
                "product": {
                  "name": "Schneider Electric ZBRCETH Modbus TCP communication \u003e=SV:02.05|\u003e=PV:03|\u003e=RL:03",
                  "product_id": "CSAFPID-0035"
                }
              }
            ],
            "category": "product_name",
            "name": "ZBRCETH Modbus TCP communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric ACE850 Sepam communication interface all versions",
                  "product_id": "CSAFPID-0026"
                }
              }
            ],
            "category": "product_name",
            "name": "ACE850 Sepam communication interface"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Acti9 Smartlink EL B A9XELC08 all versions",
                  "product_id": "CSAFPID-0027"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 Smartlink EL B A9XELC08"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Acti9 Smartlink IP all versions",
                  "product_id": "CSAFPID-0028"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 Smartlink IP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.7.4",
                "product": {
                  "name": "Schneider Electric Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D) version V1.7.4 and prior",
                  "product_id": "CSAFPID-0029"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "V6.2",
                "product": {
                  "name": "Schneider Electric Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D) V6.2",
                  "product_id": "CSAFPID-0053"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Andover Continuum controller models all versions",
                  "product_id": "CSAFPID-0030",
                  "product_identification_helper": {
                    "model_numbers": [
                      "NetController 1 (NC1) = Model CX9900",
                      "NetController 2 (NC2) = Model CX9680",
                      "ACX2 = Model ACX5720 and ACX5740",
                      "CX9200 series",
                      "CX9400 series",
                      "CX9924",
                      "CX9702",
                      "BCX4040 series",
                      "BCX9640 series"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Andover Continuum controller models"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.7.4",
                "product": {
                  "name": "Schneider Electric Wiser Energy IP module by Schneider Electric (EER31800) version V1.7.4 and prior",
                  "product_id": "CSAFPID-0031"
                }
              },
              {
                "category": "product_version",
                "name": "6.2",
                "product": {
                  "name": "Schneider Electric Wiser Energy IP module by Schneider Electric (EER31800) 6.2",
                  "product_id": "CSAFPID-0054"
                }
              }
            ],
            "category": "product_name",
            "name": "Wiser Energy IP module by Schneider Electric (EER31800)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.7.4",
                "product": {
                  "name": "Schneider Electric Wiser Energy IP module by Clipsal (EER72600) version V1.7.4 and prior",
                  "product_id": "CSAFPID-0032"
                }
              },
              {
                "category": "product_version",
                "name": "6.2",
                "product": {
                  "name": "Schneider Electric Wiser Energy IP module by Clipsal (EER72600) 6.2",
                  "product_id": "CSAFPID-0056"
                }
              }
            ],
            "category": "product_name",
            "name": "Wiser Energy IP module by Clipsal (EER72600)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V1.7.4",
                "product": {
                  "name": "Schneider Electric Gateway Connector by Elko (EKO01827) version V1.7.4 and prior",
                  "product_id": "CSAFPID-0033"
                }
              },
              {
                "category": "product_version",
                "name": "6.2",
                "product": {
                  "name": "Schneider Electric Gateway Connector by Elko (EKO01827) 6.2",
                  "product_id": "CSAFPID-0057"
                }
              }
            ],
            "category": "product_name",
            "name": "Gateway Connector by Elko (EKO01827)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c001.008.007",
                "product": {
                  "name": "Schneider Electric Acti9 PowerTag Link / HD version prior to 001.008.007",
                  "product_id": "CSAFPID-0034"
                }
              },
              {
                "category": "product_version",
                "name": "7.0",
                "product": {
                  "name": "Schneider Electric Acti9 PowerTag Link / HD 7.0",
                  "product_id": "CSAFPID-0055"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 PowerTag Link / HD"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c002.004.002",
                "product": {
                  "name": "Schneider Electric Acti9 Smartlink SI D version prior to 002.004.002",
                  "product_id": "CSAFPID-0036"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 Smartlink SI D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c002.004.002",
                "product": {
                  "name": "Schneider Electric Acti9 Smartlink SI B version prior to 002.004.002",
                  "product_id": "CSAFPID-0037"
                }
              }
            ],
            "category": "product_name",
            "name": "Acti9 Smartlink SI B"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V5.1.15",
                "product": {
                  "name": "Schneider Electric EGX150/Link150 Ethernet Gateway version V5.1.15 and prior",
                  "product_id": "CSAFPID-0038"
                }
              },
              {
                "category": "product_version",
                "name": "V5.1.18",
                "product": {
                  "name": "Schneider Electric EGX150/Link150 Ethernet Gateway V5.1.18",
                  "product_id": "CSAFPID-0039"
                }
              }
            ],
            "category": "product_name",
            "name": "EGX150/Link150 Ethernet Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.001.000",
                "product": {
                  "name": "Schneider Electric eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers Firmware versions prior to V4.001.000",
                  "product_id": "CSAFPID-0042"
                }
              }
            ],
            "category": "product_name",
            "name": "eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric EcoStruxure Building SmartX IP MP Controllers all versions",
                  "product_id": "CSAFPID-0040"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=3.02.02",
                "product": {
                  "name": "Schneider Electric EcoStruxure Building SmartX IP MP Controllers versions 3.02.02 and later",
                  "product_id": "CSAFPID-0041"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure Building SmartX IP MP Controllers"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric EcoStruxure Building SmartX IP RP Controllers All versions",
                  "product_id": "CSAFPID-0043"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=3.02.02",
                "product": {
                  "name": "Schneider Electric EcoStruxure Building SmartX IP RP Controllers version 3.02.02 and later",
                  "product_id": "CSAFPID-0044"
                }
              }
            ],
            "category": "product_name",
            "name": "EcoStruxure Building SmartX IP RP Controllers"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.001.000",
                "product": {
                  "name": "Schneider Electric IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers Firmware versions prior to V4.001.000",
                  "product_id": "CSAFPID-0046"
                }
              }
            ],
            "category": "product_name",
            "name": "IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.011.003",
                "product": {
                  "name": "Schneider Electric IFE Gateway Firmware versions prior to V3.011.003",
                  "product_id": "CSAFPID-0045"
                }
              }
            ],
            "category": "product_name",
            "name": "IFE Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=3.0",
                "product": {
                  "name": "Schneider Electric PowerLogic EGX100 Ethernet Gateway verison 3.0 and later",
                  "product_id": "CSAFPID-0047"
                }
              }
            ],
            "category": "product_name",
            "name": "PowerLogic EGX100 Ethernet Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric PowerLogic EGX300 Ethernet Gateway all version",
                  "product_id": "CSAFPID-0048"
                }
              }
            ],
            "category": "product_name",
            "name": "PowerLogic EGX300 Ethernet Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Specified in Download Links section",
                "product": {
                  "name": "Schneider Electric PowerLogic PM5000 series power meters Specified in Download Links section",
                  "product_id": "CSAFPID-0049"
                }
              }
            ],
            "category": "product_name",
            "name": "PowerLogic PM5000 series power meters"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=V2.8",
                "product": {
                  "name": "Schneider Electric TeSys T LTMRxxEyy Motor Controllers version V2.8 and prior",
                  "product_id": "CSAFPID-0050"
                }
              },
              {
                "category": "product_version",
                "name": "V2.9",
                "product": {
                  "name": "Schneider Electric TeSys T LTMRxxEyy Motor Controllers V2.9",
                  "product_id": "CSAFPID-0051"
                }
              }
            ],
            "category": "product_name",
            "name": "TeSys T LTMRxxEyy Motor Controllers"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11896",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11897",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11898",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11899",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11900",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11901",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11902",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11903",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11904",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11905",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11906",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11907",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11908",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11909",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11910",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11911",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11912",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11913",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-11914",
      "notes": [
        {
          "category": "details",
          "text": "Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003",
          "CSAFPID-0005",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0011",
          "CSAFPID-0013",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0025",
          "CSAFPID-0053",
          "CSAFPID-0054",
          "CSAFPID-0056",
          "CSAFPID-0057"
        ],
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006",
          "CSAFPID-0008",
          "CSAFPID-0010",
          "CSAFPID-0012",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0052",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0023",
          "CSAFPID-0024",
          "CSAFPID-0026",
          "CSAFPID-0027",
          "CSAFPID-0028",
          "CSAFPID-0029",
          "CSAFPID-0030",
          "CSAFPID-0031",
          "CSAFPID-0032",
          "CSAFPID-0033",
          "CSAFPID-0034",
          "CSAFPID-0036",
          "CSAFPID-0037",
          "CSAFPID-0038",
          "CSAFPID-0039",
          "CSAFPID-0042",
          "CSAFPID-0043",
          "CSAFPID-0045",
          "CSAFPID-0046",
          "CSAFPID-0047",
          "CSAFPID-0048",
          "CSAFPID-0050"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.2IE25 and above.\nFor product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE33 and above.\nFor product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V3.3IE26 and above.\nFor product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.\nDownload and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.2.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in firmware version V2.1.1.1 available for download below:\nhttps://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/",
          "product_ids": [
            "CSAFPID-0016"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0018"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0019"
          ]
        },
        {
          "category": "none_available",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0052"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 \u0026 ALTIVAR 600 ranges.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0020"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0021"
          ]
        },
        {
          "category": "mitigation",
          "details": "This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.\nFor other CVEs, the CVSS score is evaluated as Medium in the product context.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0022"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in product releases V1.15IE25 and above.\nFor product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.",
          "product_ids": [
            "CSAFPID-0023"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is now available in product releases\nSV:02.05, PV:03, RL:03 and above.\nFor product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for\nmore information on upgrading to SV:02.05.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        },
        {
          "category": "mitigation",
          "details": "The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.\nTo minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:\n- Enable the IP-based filtering capability in the ACE850\n- Place strong, active controls on the network hosting the ACE850\n- Consider moving to a newer relay such as the Easergy series if product-level access protections are required\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0026"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization Offer.\nIf possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.\nFor specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.",
          "product_ids": [
            "CSAFPID-0027"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0028"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0029"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nCustomers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.\nCustomers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.",
          "product_ids": [
            "CSAFPID-0030"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0031"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0032"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.\nGoogle Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec\nApple App Store for Apple devices:\nhttps://apps.apple.com/au/app/esetup-for-electrician/id1087855591",
          "product_ids": [
            "CSAFPID-0033"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0034"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab",
          "product_ids": [
            "CSAFPID-0036",
            "CSAFPID-0037"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab",
          "product_ids": [
            "CSAFPID-0038"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0042"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required.",
          "product_ids": [
            "CSAFPID-0040"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "All issues remediated in the 3.02.02\nrelease, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/\n1. Search for \u2018relebov3.2.1\u2019\n2. Set the Filter criteria to RN or Firmware, as required",
          "product_ids": [
            "CSAFPID-0043"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0046"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:\nhttps://www.se.com/ww/en/download/document/Ecoreach_Installer/",
          "product_ids": [
            "CSAFPID-0045"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0047"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "This is an End of Commercialization offer.\nIf possible, this product should be replaced by Com\u2019X510 (commercial reference: EBX510) which is not impacted by this vulnerability.\nTo reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.",
          "product_ids": [
            "CSAFPID-0048"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation\n\"PM5560, PM5563, PM5580\",V2.7.8 and earlier,\"A fix in V2.8.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip\u0026p_Doc_Ref=PM5560_PM5563_PM5580\"\nPM5561,V10.7.1 and earlier,\"A fix in V10.7.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5561_upgrade_10.7.3_Release.zip\u0026p_Doc_Ref=PM5561\"\nPM5650,V2.10.1 and earlier,\"A fix in V2.11.2 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5650_upgrade_V2.11.2_Release.zip\u0026p_Doc_Ref=PM5650\"\nPM5570,V3.1.0 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5570_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5570\"\nPM5660,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5660_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5660\"\nPM5760,V3.1.1 and earlier,\"A fix in V3.1.3 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5760_upgrade_V3.1.3_Release.zip\u0026p_Doc_Ref=PM5760\"\n\"PM5320, PM5340\",V2.1.3 and earlier,\"A fix in V2.1.5 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip\u0026p_Doc_Ref=PM5320_PM5340\"\nPM5341,V2.4.1 and earlier,\"A fix in V2.4.4 is now available for download:\nhttps://download.schneider-electric.com/files?p_enDocType=Firmware\u0026p_File_Name=PM5341_v2.4.4_HW_vB1.zip\u0026p_Doc_Ref=PM5341\"",
          "product_ids": [
            "CSAFPID-0049"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:\nhttps://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip\u0026p_enDocType=Firmware\u0026p_Doc_Ref=Evo_TeSysT_Pack-13",
          "product_ids": [
            "CSAFPID-0050"
          ]
        },
        {
          "category": "mitigation",
          "details": "Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.\nFor devices on a local network:\n\u2022 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.\n\u2022 Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.\n\u2022 Disable DHCP on the NMC and configure it to use a static IP address.\n\u2022 To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.\n\u2022 If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall\n\u2022 Enable only secure remote access methods. Disable any insecure protocols.\nFor devices that must communicate via the Internet:\n\u2022 Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.\nIf network access is not required:\n\u2022 Remove the Ethernet cable from the affected device.\nAdditional mitigations:\n\u2022 Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.\nFor more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}

CVE-2020-11910 (GCVE-0-2020-11910)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:52 – Updated: 2025-09-30 15:49

Summary

The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.800Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-11910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T15:49:31.482628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T15:49:44.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:23:04.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11910",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11910",
    "datePublished": "2020-06-17T10:52:48.000Z",
    "dateReserved": "2020-04-19T00:00:00.000Z",
    "dateUpdated": "2025-09-30T15:49:44.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11902 (GCVE-0-2020-11902)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:36 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.332Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:07:37",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11902",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11902",
    "datePublished": "2020-06-17T10:36:19",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11899 (GCVE-0-2020-11899)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:27 – Updated: 2025-10-21 23:35

Summary

The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

Assigner

mitre

References

URL

Tags

	https://cwe.mitre.org/data/definitions/125.html	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.intel.com/content/www/us/en/security-…	x_refsource_CONFIRM
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cwe.mitre.org/data/definitions/125.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-11899",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T19:52:23.602712Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:35:41.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-03T00:00:00+00:00",
            "value": "CVE-2020-11899 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-10T20:15:50.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cwe.mitre.org/data/definitions/125.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11899",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cwe.mitre.org/data/definitions/125.html",
              "refsource": "MISC",
              "url": "https://cwe.mitre.org/data/definitions/125.html"
            },
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11899",
    "datePublished": "2020-06-17T10:27:59.000Z",
    "dateReserved": "2020-04-19T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:35:41.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11901 (GCVE-0-2020-11901)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:34 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:06:35",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11901",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11901",
    "datePublished": "2020-06-17T10:34:01",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11900 (GCVE-0-2020-11900)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:30 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.intel.com/content/www/us/en/security-…	x_refsource_CONFIRM
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.626Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:05:32",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11900",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11900",
    "datePublished": "2020-06-17T10:30:24",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11908 (GCVE-0-2020-11908)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:49 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.840Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 4.7.1.27 mishandles \u0027\\0\u0027 termination in DHCP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:21:24",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11908",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 4.7.1.27 mishandles \u0027\\0\u0027 termination in DHCP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11908",
    "datePublished": "2020-06-17T10:49:17",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11912 (GCVE-0-2020-11912)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:56 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:27:02",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11912",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11912",
    "datePublished": "2020-06-17T10:56:38",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11896 (GCVE-0-2020-11896)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:21 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.799Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-21T23:54:33",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11896",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11896",
    "datePublished": "2020-06-17T10:21:31",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11907 (GCVE-0-2020-11907)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:47 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.826Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:20:08",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11907",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11907",
    "datePublished": "2020-06-17T10:47:17",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11914 (GCVE-0-2020-11914)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:59 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:28:36",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11914",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11914",
    "datePublished": "2020-06-17T10:59:51",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11906 (GCVE-0-2020-11906)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:44 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.303Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:19:22",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11906",
    "datePublished": "2020-06-17T10:44:58",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11898 (GCVE-0-2020-11898)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:26 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.831Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-21T23:58:33",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11898",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11898",
    "datePublished": "2020-06-17T10:26:18",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11905 (GCVE-0-2020-11905)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:43 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.intel.com/content/www/us/en/security-…	x_refsource_CONFIRM
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:11:51",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11905",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11905",
    "datePublished": "2020-06-17T10:43:14",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11903 (GCVE-0-2020-11903)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:37 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.759Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:09:26",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11903",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11903",
    "datePublished": "2020-06-17T10:37:56",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11909 (GCVE-0-2020-11909)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:51 – Updated: 2025-09-30 15:52

Summary

The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.743Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-11909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T15:51:45.294712Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-191",
                "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T15:52:16.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:22:13.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11909",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11909",
    "datePublished": "2020-06-17T10:51:09.000Z",
    "dateReserved": "2020-04-19T00:00:00.000Z",
    "dateUpdated": "2025-09-30T15:52:16.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11897 (GCVE-0-2020-11897)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:23 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.687Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-21T23:57:24",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11897",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11897",
    "datePublished": "2020-06-17T10:23:22",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11911 (GCVE-0-2020-11911)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:55 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://support.hpe.com/hpesc/public/docDisplay?d…	x_refsource_MISC
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.872Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:23:56",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11911",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbhf04012en_us"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11911",
    "datePublished": "2020-06-17T10:55:05",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11904 (GCVE-0-2020-11904)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:41 – Updated: 2025-09-30 14:49

Summary

The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-11904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T14:49:41.242680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T14:49:48.244Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:10:30.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11904",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11904",
    "datePublished": "2020-06-17T10:41:12.000Z",
    "dateReserved": "2020-04-19T00:00:00.000Z",
    "dateUpdated": "2025-09-30T14:49:48.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11913 (GCVE-0-2020-11913)

Vulnerability from cvelistv5 – Published: 2020-06-17 10:58 – Updated: 2024-08-04 11:42

Summary

The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.kb.cert.org/vuls/id/257161/	x_refsource_MISC
	https://www.treck.com	x_refsource_MISC
	https://jsof-tech.com/vulnerability-disclosure-policy/	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/257161	third-party-advisoryx_refsource_CERT-VN
	https://www.jsof-tech.com/ripple20/	x_refsource_MISC
	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.arubanetworks.com/assets/alert/ARUBA-P…	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
	https://www.dell.com/support/article/de-de/sln321…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.treck.com"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
          },
          {
            "name": "VU#257161",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/257161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.jsof-tech.com/ripple20/"
          },
          {
            "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-22T00:27:47",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.treck.com"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
        },
        {
          "name": "VU#257161",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/257161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.jsof-tech.com/ripple20/"
        },
        {
          "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11913",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kb.cert.org/vuls/id/257161/",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/257161/"
            },
            {
              "name": "https://www.treck.com",
              "refsource": "MISC",
              "url": "https://www.treck.com"
            },
            {
              "name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
              "refsource": "MISC",
              "url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
            },
            {
              "name": "VU#257161",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/257161"
            },
            {
              "name": "https://www.jsof-tech.com/ripple20/",
              "refsource": "MISC",
              "url": "https://www.jsof-tech.com/ripple20/"
            },
            {
              "name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
            },
            {
              "name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11913",
    "datePublished": "2020-06-17T10:58:24",
    "dateReserved": "2020-04-19T00:00:00",
    "dateUpdated": "2024-08-04T11:42:00.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SEVD-2020-175-01

CVE-2020-11910 (GCVE-0-2020-11910)

CVE-2020-11902 (GCVE-0-2020-11902)

CVE-2020-11899 (GCVE-0-2020-11899)

CVE-2020-11901 (GCVE-0-2020-11901)

CVE-2020-11900 (GCVE-0-2020-11900)

CVE-2020-11908 (GCVE-0-2020-11908)

CVE-2020-11912 (GCVE-0-2020-11912)

CVE-2020-11896 (GCVE-0-2020-11896)

CVE-2020-11907 (GCVE-0-2020-11907)

CVE-2020-11914 (GCVE-0-2020-11914)

CVE-2020-11906 (GCVE-0-2020-11906)

CVE-2020-11898 (GCVE-0-2020-11898)

CVE-2020-11905 (GCVE-0-2020-11905)

CVE-2020-11903 (GCVE-0-2020-11903)

CVE-2020-11909 (GCVE-0-2020-11909)

CVE-2020-11897 (GCVE-0-2020-11897)

CVE-2020-11911 (GCVE-0-2020-11911)

CVE-2020-11904 (GCVE-0-2020-11904)

CVE-2020-11913 (GCVE-0-2020-11913)

Tags

Sightings

Nomenclature