CVE-2020-28215

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03	Third Party Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-06/	Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03	Third Party Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-06/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
References	~~() https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03 - Third Party Advisory~~	() https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03 - Third Party Advisory
References	~~() https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - Vendor Advisory~~	() https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - Vendor Advisory

Information

Published : 2020-12-11 01:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28215

Mitre link : CVE-2020-28215

CVE.ORG link : CVE-2020-28215

JSON object : View

Products Affected

schneider-electric

easergy_t300_firmware
easergy_t300

CWE

CWE-862

Missing Authorization

{"id": "CVE-2020-28215", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-12-11T01:15:11.547", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03", "tags": ["Third Party Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-06/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-06/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently."}, {"lang": "es", "value": "Una CWE-862: Se presenta una vulnerabilidad de Falta de Autorizaci\u00f3n en Easergy T300 (versiones de firmware 2.7 y anteriores), que podr\u00eda causar una amplia gama de problemas, incluyendo exposiciones de informaci\u00f3n, denegaci\u00f3n de servicio y ejecuci\u00f3n de c\u00f3digo arbitraria cuando las comprobaciones de control de acceso no son aplicadas de manera consistente"}], "lastModified": "2024-11-21T05:22:29.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7763787-4033-4B18-B50E-67B47C6388FA", "versionEndIncluding": "2.7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "45E6C3FA-001D-449A-A512-327FA0C9AC5A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@se.com"}