EcoStruxure Geo SCADA Expert

Schneider Electric Security Notification 8-Dec-20 Document Reference Number – SEVD-2020 -343-02 Page 1 of 4 ## EcoStruxure Geo SCADA Expert 8 December 2020 # Overview Schneider Electric is aware of a vulnerability in the Schneider Electric EcoStruxure Geo SCADA Expert product. EcoStruxure Geo SCADA Expert software is an integrated, scalable and reliable Supervisory Control and Data Acquisition (SCADA) software with ready-to-use telemetry features optimized for managing remote assets spread across geographically dispersed infrastructure. Failure to apply the remediations provided below may risk the revealing of account credentials, which could result in unauthorized system access. # Affected Products & Versions Product Version EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1 EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1 # Vulnerability Details CVE ID: CVE-2020-28219 CVSS v3.0 Base Score 6.5 | Medium | CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX. # Remediation Product Remediation EcoStruxure Geo SCADA Expert 2019 The Monthly Updates from October 2020, 81.7613.1 include a fix for this vulnerability. Software is available for download here: https://tprojects.schneider-electric.com/telemetry/display/CS/Geo+SCADA+Expert+Downloads Schneider Electric Security Notification 8-Dec-20 Document Reference Number – SEVD-2020 -343-02 Page 2 of 4 EcoStruxure Geo SCADA Expert 2020 The Monthly Updates from October 2020, 83.7613.1 include a fix for this vulnerability. Software is available for download here: https://tprojects.schneider-electric.com/telemetry/display/CS/Geo+SCADA+Expert+Downloads