Skip to content
OpenAdvisories
High ICSA-20-142-02 5 CVEs

Schneider Electric EcoStruxure Operator Terminal Expert

Published May 21, 2020 · Updated May 21, 2020

Vendor: Schneider Electric Product: EcoStruxure Operator Terminal Expert 3.1

Summary

Successful exploitation of these vulnerabilities could allow unauthorized write access or remote code execution.

Vulnerabilities 5

  • Unscored —
    CVE-2020-7493

    A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in …

  • Unscored —
    CVE-2020-7494

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStr…

  • Unscored —
    CVE-2020-7495

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file …

  • Unscored —
    CVE-2020-7496

    A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service P…

  • Unscored —
    CVE-2020-7497

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStr…

Revision history

  1. #1

    ICSA-20-142-02 Schneider Electric EcoStruxure Operator Terminal Expert

References