Skip to content
OpenAdvisories
High SEVD-2020-252-01 5 CVEs

SCADAPack x70 Remote Connect and SCADAPack x70 Security Administrator

Published Sep 8, 2020 · Updated Feb 9, 2021 · Revision 3

Vendor: Schneider Electric Product: SCADAPack x70 Remote Connect Product: SCADAPack x70 RemoteConnect Product: SCADAPack x70 Security Administrator

Summary

Schneider Electric is aware of multiple vulnerabilities in the SCADAPack x70 Remote Connect
and the SCADAPack x70 Security Administrator applications.

Vulnerabilities 5

  • High 7.3
    CVE-2020-12525

    WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component

    M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.

    Weidmüller M&M Software Pepperl+Fuchs/PACTware WI Manager
  • Unscored —
    CVE-2020-7529

    A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADA…

  • Unscored —
    CVE-2020-7530

    A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allow…

  • Unscored —
    CVE-2020-7531

    A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allo…

  • Unscored —
    CVE-2020-7532

    A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and pr…

Revision history

  1. #1.2.0

    Replaced CVE-2020-7528 with the pre-existing CVE-2020-12525 assigned to M&M Software, eliminating the duplicate entry for the same vulnerability.(page 1).

  2. #1.1.0

    Corrected fix version of RemoteConnect from V2.3.2 to V2.4.2 package (page 2).

  3. #1.0.0

    Original Release

References