CVE-2020-7500 CRITICAL

Published: 2020-06-16 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.

Additional Descriptions (1)

Una CWE-89: Se presenta una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales utilizados en un Comando SQL ("SQL Injection'') en U.motion Servers and Touch Panels (versiones afectadas listadas en la notificación de seguridad) lo cual podrían causar una ejecución de código arbitraria cuando un comando malicioso es ingresado

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-89
[email protected]	Primary	en CWE-89

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	mtn6501-0001_firmware	*	<built-in method update of dict object at 0x7e60bae49e80>	Operating System
schneider-electric	mtn6501-0002_firmware	*	<built-in method update of dict object at 0x7e60bae48340>	Operating System
schneider-electric	mtn6260-0410_firmware	*	<built-in method update of dict object at 0x7e60bae4be80>	Operating System
schneider-electric	mtn6260-0415_firmware	*	<built-in method update of dict object at 0x7e60eb2b6540>	Operating System
schneider-electric	mtn6260-0310_firmware	*	<built-in method update of dict object at 0x7e60bae49600>	Operating System
schneider-electric	mtn6260-0315_firmware	*	<built-in method update of dict object at 0x7e60bae49c80>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6501-0001_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6501-0001:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6501-0002_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6501-0002:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6260-0410_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6260-0410:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6260-0415_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6260-0415:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6260-0310_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6260-0310:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:mtn6260-0315_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:mtn6260-0315:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2020-133-03/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-133-03/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory