Critical ICSA-20-343-03 5 CVEs

Schneider Electric Easergy T300

Published Dec 8, 2020 · Updated Dec 8, 2020

Vendor: Schneider Electric Product: Easergy T300 with firmware

Summary

Successful exploitation of this vulnerability could allow an attacker to obtain unauthorized access to the internal product LAN, which could result in exposure of sensitive information, denial of service, and remote code execution when access to a resource from an attacker is not restricted or incorrectly restricted.

Vulnerabilities 5

Unscored —

CVE-2020-28215

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide…

Dec 11, 2020
Unscored —

CVE-2020-28216

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that wou…

Dec 11, 2020
Unscored —

CVE-2020-28217

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that wou…

Dec 11, 2020
Unscored —

CVE-2020-28218

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and…

Dec 11, 2020
Unscored —

CVE-2020-7561

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and old…

Nov 19, 2020

Revision history

2020-12-08 #1
ICSA-20-343-03 Schneider Electric Easergy T300

References

ICS Advisory ICSA-20-343-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-343-03
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B