CVE-2020-7491 HIGH

Published: 2020-07-23 | Last Modified: 2024-11-21 | Status: Modified

Description

**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4.

Additional Descriptions (1)

**VERSION NO SOPORTADA CUANDO SE ASIGNÓ** Una cuenta de puerto de depuración heredada en los TCM instalados en sistema Tricon versiones 10.2.0 hasta 10.5.3, es visible en la red y podría permitir un acceso inapropiado. Esta vulnerabilidad es corregida en TCM versión 10.5.4

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Primary	en NVD-CWE-noinfo

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	tricon_tcm_4351_firmware	*	<built-in method update of dict object at 0x7e60e8c7ffc0>	Operating System
schneider-electric	tricon_tcm_4352_firmware	*	<built-in method update of dict object at 0x7e60e8c7c1c0>	Operating System
schneider-electric	tricon_tcm_4351a_firmware	*	<built-in method update of dict object at 0x7e60e8c7e8c0>	Operating System
schneider-electric	tricon_tcm_4351b_firmware	*	<built-in method update of dict object at 0x7e60ba0acb00>	Operating System
schneider-electric	tricon_tcm_4352a_firmware	*	<built-in method update of dict object at 0x7e60ba0ac300>	Operating System
schneider-electric	tricon_tcm_4352b_firmware	*	<built-in method update of dict object at 0x7e60ba0ae700>	Operating System
schneider-electric	tristation_1131_firmware	*	<built-in method update of dict object at 0x7e60ba0af540>	Operating System
schneider-electric	tristation_1131_firmware	*	<built-in method update of dict object at 0x7e60ba0ae400>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4351_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4351:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4352_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4352:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4351a_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4351a:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4351b_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4351b:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4352a_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4352a:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tricon_tcm_4352b_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tricon_tcm_4352b:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tristation_1131_firmware::::::::`
Yes	`cpe:2.3:o:schneider-electric:tristation_1131_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tristation_1131:-:::::::*`

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
Source: [email protected]

Third Party Advisory US Government Resource
https://www.se.com/ww/en/download/document/SESB-2020-105-01/
Source: [email protected]

Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory US Government Resource
https://www.se.com/ww/en/download/document/SESB-2020-105-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory