Schneider Electric Software Update (SESU)

Schneider Electric Security Notification 14-Jul-20 Document Reference Number – SEVD-2020 -196-01 Page 1 of 4 ## Schneider Electric Software Update (SESU) 14 July 2020 ## Overview Schneider Electric is aware of a vulnerability in the Schneider Electric Software Update (SESU) product. ## Affected Product(s) Schneider Electric Software Update (SESU) V2.4.0 and prior. Schneider Electric Software Update is used by the following products*: • EcoStruxure Augmented Operator Advisor • EcoStruxure Control Expert (formerly known as Unity Pro) • EcoStruxure Hybrid Distributed Control System (DCS) • EcoStruxure Machine Expert (formerly known as SoMachine) • EcoStruxure Machine Expert Basic • EcoStruxure Operator Terminal Expert • Eurotherm Data Reviewer • Eurotherm iTools • eXLhoist Configuration Software • Schneider Electric Floating License Manager • Schneider Electric License Manager • Harmony XB5SSoft • SoMachine Motion • SoMove • Versatile Software BLUE • Vijeo Designer • OsiSense XX Configuration Software • Zelio Soft 2 *Note: includes but not limited to the offers listed Schneider Electric Security Notification 14-Jul-20 Document Reference Number – SEVD-2020 -196-01 Page 2 of 4 ## Vulnerability Details CVE ID: CVE-2020-7520 CVSS v3.0 Base Score 7.9 | High | CVSS V3.0: AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists which could cause execution of malicious code on the victim´s machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker’s possession. A man-in-the-middle attack is then used to complete the exploit. ## Remediation This vulnerability is fixed in version 2.5.0 and is available for download below: