cnvd - cnvd-2020-23198

cnvd-2020-23198

Vulnerability from cnvd

Title: 多款Schneider Electric产品注入漏洞

Description:

Schneider Electric Modicon M580等都是法国施耐德电气（Schneider Electric）公司的产品。Schneider Electric Modicon M580是一款可编程自动化控制器。Schneider Electric Modicon M340是一款用于工业过程和基础设施的中程PLC（可编程逻辑控制器）。Schneider Electric EcoStruxure Control Expert（前称Unity Pro）是一套用于Schneider Electric逻辑控制器产品的编程软件。

多款Schneider Electric产品中存在注入漏洞，攻击者可利用该漏洞向控制器中发送恶意代码。

Severity: 高

Patch Name: 多款Schneider Electric产品注入漏洞的补丁

Patch Description:

多款Schneider Electric产品中存在注入漏洞，攻击者可利用该漏洞向控制器中发送恶意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.se.com/ww/en/download/document/SEVD-2020-080-01/

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-7475

Impacted products

Name
['Schneider Electric Unity Pro', 'Schneider Electric EcoStruxure Control Expert <14.1 Hot Fix', 'Schneider Electric Modicon M340 <3.20', 'Schneider Electric Modicon M580 <3.10']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-7475"
    }
  },
  "description": "Schneider Electric Modicon M580\u7b49\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Schneider Electric Modicon M580\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u63a7\u5236\u5668\u3002Schneider Electric Modicon M340\u662f\u4e00\u6b3e\u7528\u4e8e\u5de5\u4e1a\u8fc7\u7a0b\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u4e2d\u7a0bPLC\uff08\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff09\u3002Schneider Electric EcoStruxure Control Expert\uff08\u524d\u79f0Unity Pro\uff09\u662f\u4e00\u5957\u7528\u4e8eSchneider Electric\u903b\u8f91\u63a7\u5236\u5668\u4ea7\u54c1\u7684\u7f16\u7a0b\u8f6f\u4ef6\u3002\n\n\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u4e2d\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411\u63a7\u5236\u5668\u4e2d\u53d1\u9001\u6076\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.se.com/ww/en/download/document/SEVD-2020-080-01/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-23198",
  "openTime": "2020-04-17",
  "patchDescription": "Schneider Electric Modicon M580\u7b49\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Schneider Electric Modicon M580\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u63a7\u5236\u5668\u3002Schneider Electric Modicon M340\u662f\u4e00\u6b3e\u7528\u4e8e\u5de5\u4e1a\u8fc7\u7a0b\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u4e2d\u7a0bPLC\uff08\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff09\u3002Schneider Electric EcoStruxure Control Expert\uff08\u524d\u79f0Unity Pro\uff09\u662f\u4e00\u5957\u7528\u4e8eSchneider Electric\u903b\u8f91\u63a7\u5236\u5668\u4ea7\u54c1\u7684\u7f16\u7a0b\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u4e2d\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411\u63a7\u5236\u5668\u4e2d\u53d1\u9001\u6076\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Schneider Electric Unity Pro",
      "Schneider Electric EcoStruxure Control Expert \u003c14.1 Hot Fix",
      "Schneider Electric Modicon M340 \u003c3.20",
      "Schneider Electric Modicon M580 \u003c3.10"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-7475",
  "serverity": "\u9ad8",
  "submitTime": "2020-03-24",
  "title": "\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2020-7475 (GCVE-0-2020-7475)

Vulnerability from cvelistv5

Published

2020-03-23 18:56

Modified

2024-08-04 09:33

Severity ?

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.

References

▼	URL	Tags
	http://www.se.com/ww/en/download/document/SEVD-2020-080-01	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)	Version: EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:33:18.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.se.com/ww/en/download/document/SEVD-2020-080-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-23T18:56:18",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.se.com/ww/en/download/document/SEVD-2020-080-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@schneider-electric.com",
          "ID": "CVE-2020-7475",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.se.com/ww/en/download/document/SEVD-2020-080-01",
              "refsource": "MISC",
              "url": "http://www.se.com/ww/en/download/document/SEVD-2020-080-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2020-7475",
    "datePublished": "2020-03-23T18:56:18",
    "dateReserved": "2020-01-21T00:00:00",
    "dateUpdated": "2024-08-04T09:33:18.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted