CVE-2020-7548 CRITICAL

Published: 2020-12-01 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information) that could allow unauthorized users to login.

Additional Descriptions (1)

Una CWE-330: Se presenta una vulnerabilidad uso de Valores Insuficientemente Aleatorios en Gateways Serie Smartlink, PowerTag y Wiser (véase la notificación de seguridad para la información de la versión) que podría permitir a usuarios no autorizados iniciar sesión

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-330

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	acti9_smartlink_si_d_firmware	*	<built-in method update of dict object at 0x7e6111c1de80>	Operating System
schneider-electric	acti9_smartlink_si_b_firmware	*	<built-in method update of dict object at 0x7e6111c1fd80>	Operating System
schneider-electric	acti9_powertag_link_firmware	*	<built-in method update of dict object at 0x7e6111c1e000>	Operating System
schneider-electric	acti9_powertag_link_hd_firmware	*	<built-in method update of dict object at 0x7e60a88ad680>	Operating System
schneider-electric	acti9_smartlink_el_b_firmware	*	<built-in method update of dict object at 0x7e6111c1d100>	Operating System
schneider-electric	wiser_link_firmware	*	<built-in method update of dict object at 0x7e6111c1ee40>	Operating System
schneider-electric	wiser_energy_firmware	*	<built-in method update of dict object at 0x7e6111c1ca00>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:acti9_smartlink_si_d_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:acti9_smartlink_si_d:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:acti9_smartlink_si_b_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:acti9_smartlink_si_b:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:acti9_powertag_link_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:acti9_powertag_link:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:acti9_powertag_link_hd_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:acti9_powertag_link_hd:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:acti9_smartlink_el_b_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:acti9_smartlink_el_b:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:wiser_link_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:wiser_link:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:wiser_energy_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:wiser_energy:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2020-287-03/
Source: [email protected]

Patch Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-287-03/
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory