Skip to content
OpenAdvisories
High SEVD-2020-161-05 6 CVEs

Easergy Builder

Published Jun 9, 2020 · Updated May 13, 2021 · Revision 2

Vendor: Schneider Electric Product: Easergy Builder

Summary

Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple
vulnerabilities affecting the company’s Easergy Builder configuration tool. Schneider Electric
has worked closely with Ilya Karpov and Evgeniy Druzhinin of Rostelecom-Solar to remediate
the vulnerabilities and appreciates their collaboration and commitment to transparency. The
vulnerabilities have been remediated via a free software update, which is available immediately
by contacting Schneider Electric’s Customer Care Center.
Access to the customer’s network is required for the majority of the disclosed vulnerabilities to
be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion,
and care is taken to obtain software updates from a trusted source, the general risk of
exploitation can be substantially minimized.
Schneider Electric encourages customers to upgrade to the new software as soon as possible.
The company further encourages customers to ensure any firmware files used to update the
device are acquired from trusted sources; to operate the products on properly segmented
control networks; to adequately secure any workstation that has been configured to have
access to the product; and to follow the remediation and general security recommendations
below.

Vulnerabilities 6

  • Unscored —
    CVE-2020-7514

    A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 an…

  • Unscored —
    CVE-2020-7515

    A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and…

  • Unscored —
    CVE-2020-7516

    A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and pr…

  • Unscored —
    CVE-2020-7517

    A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and olde…

  • Unscored —
    CVE-2020-7518

    A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could all…

  • Unscored —
    CVE-2020-7519

    A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could a…

Revision history

  1. #1.1.0

    Updated CWE for CVE-2020-7515 and CVE-2020-7516

  2. #1.0.0

    Original Release

References