« Volver al listado

CVE-2020-7546

Estado: ModificadaMedia (5.4)—

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Schneider-electric — Ecostruxure Energy ExpertSchneider-electric — Ecostruxure Power Monitoring ExpertSchneider-electric — Power ManagerSchneider-electric — Powerscada Expert With Advanced Reporting AND DashboardsSchneider-electric — Powerscada Operation With Advanced Reporting AND Dashboards

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7546",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)",
          "versions": [
            {
              "status": "affected",
              "version": "EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-01T15:15:12.563",
  "references": [
    {
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@se.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage."
    },
    {
      "lang": "es",
      "value": "Una CWE-79: Se presenta una vulnerabilidad Neutralización Inapropiada de la Entrada Durante la Generación de Páginas Web en el Software EcoStruxureª y SmartStruxureª Power Monitoring and SCADA (véase la notificación de seguridad para la información de la versión) que podría permitir a un atacante llevar a cabo acciones en nombre del usuario autorizado cuando se acceder a un página web afectada"
    }
  ],
  "lastModified": "2026-06-17T03:24:59.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDF7DFC6-6F41-491B-A703-6AB0143FE5B1"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6819EA7A-C803-480F-98DF-44DA144FE488"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66E928C4-87C8-4BD6-9131-B7D558330CBA"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BEB4F4B-0B22-47CA-B173-C06C1A925348"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FC0093C-00CE-43A8-80EC-0509992E637B"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE9A1DF0-42B8-4123-8276-1D4BED156034"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54A54A8D-40F5-4E75-A524-B81E487DB274"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC2CF9D-8D0C-4FD3-94A2-34A63E297B81"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8F406C-868A-443C-8842-6CFFFF17C236"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}