// Description
Schneider Electric Security Notification
13-Oct-20 Document Reference Number – SEVD-2020 -287-04 Page 1 of 4
## EcoStruxure™ and SmartStruxure™
## Power Monitoring and SCADA Software
13 October 2020
# Overview
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ and SmartStruxure™ Power Monitoring & SCADA Software.
Failure to apply the mitigation provided below may risk remote code execution, which could result in an attacker gaining root level access to the underlying operating system on the impacted server.
# Affected Product and Version
EcoStruxure™ Power Monitoring Expert versions 9.0, 8.x, 7.x
EcoStruxure™ Energy Expert version 2.0
Power Manager versions 1.1, 1.2, 1.3
StruxureWare™ PowerSCADA Expert with Advanced Reporting and Dashboards Module versions 8.x
EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0
# Vulnerability Details
CVE ID: CVE-2020-7545
CVSS v3.0 Base Score 8.4 | High | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
A CWE-284:Improper Access Control vulnerability exists that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.
CVE ID: CVE-2020-7546
CVSS v3.0 Base Score 5.4 | Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
CVE ID: CVE-2020-7547
CVSS v3.0 Base Score 6.3 | Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
A CWE-284: Improper Access Control vulnerability exists that could allow a user the ability to perform actions via the web interface at a higher privilege level. Schneider Electric Security Notification
13-Oct-20 Document Reference Number – SEVD-2020 -287-04 Page 2 of 4
# Remediation
Affected Product & Version Remediation