« Volver al listado

CVE-2020-7545

Estado: ModificadaAlta (7.2)—

A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Schneider-electric — Ecostruxure Energy ExpertSchneider-electric — Ecostruxure Power Monitoring ExpertSchneider-electric — Power ManagerSchneider-electric — Powerscada Expert With Advanced Reporting AND DashboardsSchneider-electric — Powerscada Operation With Advanced Reporting AND Dashboards

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7545",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)",
          "versions": [
            {
              "status": "affected",
              "version": "EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-01T15:15:12.297",
  "references": [
    {
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@se.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage."
    },
    {
      "lang": "es",
      "value": "Una CWE-284: Se presenta una vulnerabilidad Control de Acceso Inapropiado en el Software EcoStruxureª y SmartStruxureª Power Monitoring and SCADA (véase la notificación de seguridad para la información de la versión) que podría permitir una ejecución de código arbitraria en el servidor cuando un usuario autorizado accede a una página web afectada"
    }
  ],
  "lastModified": "2026-06-17T03:24:58.907",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDF7DFC6-6F41-491B-A703-6AB0143FE5B1"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6819EA7A-C803-480F-98DF-44DA144FE488"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66E928C4-87C8-4BD6-9131-B7D558330CBA"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BEB4F4B-0B22-47CA-B173-C06C1A925348"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FC0093C-00CE-43A8-80EC-0509992E637B"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE9A1DF0-42B8-4123-8276-1D4BED156034"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54A54A8D-40F5-4E75-A524-B81E487DB274"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC2CF9D-8D0C-4FD3-94A2-34A63E297B81"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8F406C-868A-443C-8842-6CFFFF17C236"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}