U.motion Servers and Touch Panels V1.2

Schneider Electric Security Notification 12-May-20 (15-Apr-21) Document Reference Number – SEVD-2020 -133-03 V1.2 Page 1 of 5 ## U.motion Servers and Touch Panels V1.2 12 May 2020 (15 April 2021) ## Overview Schneider Electric is aware of multiple vulnerabilities in the U.motion servers and touch panel products. ## Affected Products All versions of the following: • MTN6501-0001 – U.Motion – KNX Server • MTN6501-0002 – U.Motion – KNX Server Plus • MTN6260-0410 – U.Motion KNX server Plus, Touch 10 • MTN6260-0415 – U.Motion KNX server Plus, Touch 15 • MTN6260-0310 – U.Motion KNX Client Touch 10 • MTN6260-0315 – U.Motion KNX Client Touch 15 ## Vulnerability Details CVE ID: CVE-2020-7499 CVSS v3.0 Base Score 6.3 | Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N] A CWE-863: Incorrect Authorization vulnerability exists which could cause unauthorized access when a low privileged user makes unauthorized changes. CVE ID: CVE-2020-7500 CVSS v3.0 Base Score 6.3 | Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists which could cause arbitrary code to be executed when a malicious command is entered. Schneider Electric Security Notification 12-May-20 (15-Apr-21) Document Reference Number – SEVD-2020 -133-03 V1.2 Page 2 of 5 ## Remediation These vulnerabilities are fixed in version 1.4.2 and are available for download below: Affected Product Fixed Version Download Link MTN6501-0001 – U.motion – KNX Server https://www.se.com/ww/en/product/MTN6501 -0001/u.motion---knx-server/ https://www.se.com/ww/en/product/MTN6501 -0001/u.motion---knx-server/?range=61124-u.motion&node=827505925-server&parent-category-id=2200&parent-subcategory-id=88006 - pdp-software MTN6501-0002 – U.Motion – KNX Server Plus https://www.se.com/ww/en/product/MTN6501 -0002/u.motion---knx-server-plus/