IM
IronMonkey Threat Research

CVE-2020-7500 CRITICAL

Published: 2020-06-16 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.

Additional Descriptions (1)

Una CWE-89: Se presenta una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales utilizados en un Comando SQL ("SQL Injection'') en U.motion Servers and Touch Panels (versiones afectadas listadas en la notificación de seguridad) lo cual podrían causar una ejecución de código arbitraria cuando un comando malicioso es ingresado

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-89
[email protected] Primary
en CWE-89

Affected Products

Vendor Product Version Update Type
schneider-electric mtn6501-0001_firmware * <built-in method update of dict object at 0x738c08aec980> Operating System
schneider-electric mtn6501-0002_firmware * <built-in method update of dict object at 0x738c08afa3c0> Operating System
schneider-electric mtn6260-0410_firmware * <built-in method update of dict object at 0x738c08aee140> Operating System
schneider-electric mtn6260-0415_firmware * <built-in method update of dict object at 0x738c0914fe40> Operating System
schneider-electric mtn6260-0310_firmware * <built-in method update of dict object at 0x738c08a9ac80> Operating System
schneider-electric mtn6260-0315_firmware * <built-in method update of dict object at 0x738c90133800> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6501-0001_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6501-0001:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6501-0002_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6501-0002:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0410_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0410:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0415_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0415:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0310_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0310:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:mtn6260-0315_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:mtn6260-0315:-:*:*:*:*:*:*:*

References