Medium ICSA-21-063-02 7 CVEs

ICSA-21-063-02_Schneider Electric EcoStruxure Building Operation (EBO)

Published Mar 4, 2021 · Updated Mar 4, 2021

Vendor: Schneider Electric Product: Enterprise Central installer Product: Enterprise Server installer Product: WebReports Product: WebStation

Summary

Luis Vázquez, Francisco Palma, and Diego León of Zerolynx in coordination with INCIBE and Alessandro Bosco, Luca Di Giuseppe, Alessandro Sabetta, and Massimiliano Brolli of TIM Security Red Team Research reported these vulnerabilities to Schneider Electric.

Vulnerabilities 7

High 7.0

CVE-2020-28209

A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server install…

Nov 19, 2020
Medium 6.1

CVE-2020-28210

A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in Eco…

Nov 19, 2020
Unscored —

CVE-2020-7569

A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebRep…

Nov 19, 2020
Unscored —

CVE-2020-7570

A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists…

Nov 19, 2020
Unscored —

CVE-2020-7571

A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerab…

Nov 19, 2020
Unscored —

CVE-2020-7572

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation …

Nov 19, 2020
Unscored —

CVE-2020-7573

A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that co…

Nov 19, 2020

Revision history

2021-03-04 #1
ICSA-21-063-02 Schneider Electric EcoStruxure Building Operation (EBO)

References

ICS Advisory ICSA-21-063-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-063-02