IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2020-315-06 — Easergy T300 (V2.0)

CRITICAL
CVSS 10.0
Date 2026-10-16T20:41:27+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 10-Nov-20 (8-Dec-20) Document Reference Number – SEVD-2020-315-06 V2.0 Page 1 of 4 ## Easergy T300 (V2.0) 10 November 2020 (8 December 2020) # Overview Schneider Electric is aware of a vulnerability in its Easergy T300 RTU (Remote Terminal Unit). The Easergy T300 is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the remediation provided below may allow unauthorized access to the internal product LAN (local area network). December 2020 Update: Additional CVEs have been added to this disclosure (marked in red). No additional action is required for customers who have already followed the remediation instructions provided below. # Affected Products and Versions Easergy T300 with firmware 2.7 and older # Vulnerability Details CVE ID: CVE-2020-7561 CVSS v3.0 Base Score 10 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause a wide range of problems, including information exposure, denial of service, and command execution when access to a resource from an attacker is not restricted or incorrectly restricted. CVE ID: CVE-2020-28215 CVSS v3.0 Base Score 7.7 | High | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H A CWE-862: Missing Authorization vulnerability exists that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently. CVE ID: CVE-2020-28216 CVSS v3.0 Base Score 7.6 | High | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that would allow an attacker to read network traffic over HTTP protocol. Schneider Electric Security Notification 10-Nov-20 (8-Dec-20) Document Reference Number – SEVD-2020-315-06 V2.0 Page 2 of 4 CVE ID: CVE-2020-28217

// Vulnerabilities (5)

CVE ID CVSS Score Severity Description
CVE-2020-28217 10.0 medium
The affected product is vulnerable to a missing encryption of sensitive data vulnerability, which may allow an attacker to read network traffic over IEC60870-5-104 protocol.CVE-2020-28217 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).
CVE-2020-28216 10.0 medium
The affected product is vulnerable to a missing encryption of sensitive data vulnerability, which may allow an attacker to read network traffic over HTTP protocol.CVE-2020-28216 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2020-28215 10.0 medium
The affected product is vulnerable to a missing authorization vulnerability, which may allow an attacker to gain access to sensitive information, cause a denial-of-service condition, and remotely execute arbitrary code when access control checks are not applied consistently.CVE-2020-28215 has been assigned to this vulnerability. A CVSS v3 base score of 7.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H).
CVE-2020-7561 10.0 medium
The affected product is vulnerable to a missing authentication for critical function vulnerability, which may allow an attacker to expose information, cause a denial-of-service condition, and remotely execute arbitrary code.CVE-2020-7561 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H).
CVE-2020-28218 10.0 medium
The affected product is vulnerable due to an improper restriction of rendered UI layers or frames vulnerability, which may allow an attacker to trick a user into initiating an unintended action.CVE-2020-28218 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L).

// Remediations (11)

Mitigation: Never allow mobile devices that have connected to any other network, besides the intended network, t
Never allow mobile devices that have connected to any other network, besides the intended network, to connect to the safety or control networks without proper sanitation.
Mitigation: When remote access is required, use secure methods, such as virtual private networks (VPNs). Recogni
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation: Refer to Schneider Electric's security bulletin SEVD-2020-315-06 for specific mitigation details.
Refer to Schneider Electric's security bulletin SEVD-2020-315-06 for specific mitigation details.
Mitigation: Minimize network exposure for all control system devices and systems and ensure that they are not ac
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation: For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices docume
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
Mitigation: Place all controllers in locked cabinets and never leave them in “Program” mode.
Place all controllers in locked cabinets and never leave them in “Program” mode.
Mitigation: Scan all methods of mobile data exchange with the isolated network (e.g., CDs, USB drives, etc.) bef
Scan all methods of mobile data exchange with the isolated network (e.g., CDs, USB drives, etc.) before use in the terminals or any node connected to these networks.
Mitigation: Never connect programming software to any network other than the network for which the devices are i
Never connect programming software to any network other than the network for which the devices are intended.
Mitigation: Locate control and safety system networks and remote devices behind firewalls and isolate them from
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation: Schneider Electric recommends users upgrade to v2.7.1, which is available from the Schneider Electri
Schneider Electric recommends users upgrade to v2.7.1, which is available from the Schneider Electric Customer Care Center. Alternatively, users may disable port forwarding in the product firewall.
Mitigation: Install physical controls so no unauthorized personnel can access industrial control and safety syst
Install physical controls so no unauthorized personnel can access industrial control and safety systems, components, peripheral equipment, and networks.

// References