IM
IronMonkey Threat Research

CVE-2020-7499 MEDIUM

Published: 2020-06-16 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause unauthorized access when a low privileged user makes unauthorized changes.

Additional Descriptions (1)

Una CWE-863: Se presenta una vulnerabilidad de autorización incorrecta en U.motion Servers and Touch Panels (versiones afectadas listadas en la notificación de seguridad) que podrían causar un acceso no autorizado cuando un usuario poco privilegiado realiza cambios no autorizados

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-863
[email protected] Primary
en CWE-863

Affected Products

Vendor Product Version Update Type
schneider-electric mtn6501-0001_firmware * <built-in method update of dict object at 0x71c5827a56c0> Operating System
schneider-electric mtn6501-0002_firmware * <built-in method update of dict object at 0x71c4c1d4d880> Operating System
schneider-electric mtn6260-0410_firmware * <built-in method update of dict object at 0x71c5827a5ec0> Operating System
schneider-electric mtn6260-0415_firmware * <built-in method update of dict object at 0x71c5827e3280> Operating System
schneider-electric mtn6260-0310_firmware * <built-in method update of dict object at 0x71c4cab5c900> Operating System
schneider-electric mtn6260-0315_firmware * <built-in method update of dict object at 0x71c4c220d800> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6501-0001_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6501-0001:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6501-0002_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6501-0002:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0410_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0410:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0415_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0415:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0310_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0310:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0315_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0315:-:*:*:*:*:*:*:*

References