CVE-2020-28212

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.se.com/ww/en/download/document/SEVD-2020-315-07	Patch Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-07	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
References	~~() https://www.se.com/ww/en/download/document/SEVD-2020-315-07 - Patch, Vendor Advisory~~	() https://www.se.com/ww/en/download/document/SEVD-2020-315-07 - Patch, Vendor Advisory

Information

Published : 2020-11-19 22:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28212

Mitre link : CVE-2020-28212

CVE.ORG link : CVE-2020-28212

JSON object : View

Products Affected

schneider-electric

ecostruxure_control_expert

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2020-28212", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-11-19T22:15:13.490", "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07", "tags": ["Patch", "Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus."}, {"lang": "es", "value": "CWE-307: Se presenta una vulnerabilidad de Restricci\u00f3n Inapropiada de Intentos de Autenticaci\u00f3n Excesivos en el Simulador de PLC en EcoStruxure\u00aa Control Expert (ahora Unity Pro) (todas las versiones) que podr\u00eda causar la ejecuci\u00f3n no autorizada de comandos cuando se realiza un ataque de fuerza bruta mediante Modbus"}], "lastModified": "2024-11-21T05:22:29.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18E8CCC1-A467-4FEF-964D-8481EAE892EC"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}