Multiple vulnerabilities in Schneider Electric EcoStruxure Operator Terminal Expert (Vijeo XD)
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2020-7493 CVE-2020-7494 CVE-2020-7495 CVE-2020-7496 |
| CWE-ID | CWE-89 CWE-427 CWE-22 CWE-88 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
EcoStruxure Operator Terminal Expert Client/Desktop applications / Other client software |
| Vendor | Schneider Electric |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) SQL injection
EUVDB-ID: #VU27962
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-7493
CWE-ID:
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data when parsing the parameters to "load_extension". A remote attacker can trick a victim to open a specially crafted VXDZ file and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsEcoStruxure Operator Terminal Expert: 3.1 SP1
External linkshttp://www.zerodayinitiative.com/advisories/ZDI-20-658/
http://www.se.com/ww/en/download/document/SEVD-2020-133-04/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Insecure DLL loading
EUVDB-ID: #VU27963
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-7494
CWE-ID:
CWE-427 - Uncontrolled Search Path Element
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists within the handling of VXDZ files due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsEcoStruxure Operator Terminal Expert: 3.1 SP1
External linkshttp://www.zerodayinitiative.com/advisories/ZDI-20-656/
http://www.se.com/ww/en/download/document/SEVD-2020-133-04/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Path traversal
EUVDB-ID: #VU27964
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-7495
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick a victim to open a specially crafted ZIP file and gain unauthorized write access outside of expected path folder.
MitigationInstall update from vendor's website.
Vulnerable software versionsEcoStruxure Operator Terminal Expert: 3.1 SP1
External linkshttp://www.zerodayinitiative.com/advisories/ZDI-20-657/
http://www.se.com/ww/en/download/document/SEVD-2020-133-04/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Argument Injection
EUVDB-ID: #VU27966
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-7496
CWE-ID:
CWE-88 - Argument Injection or Modification
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain write access to the system.
The vulnerability exists due to the argument injection or modification issue. A remote attacker can trick a victim to open a specially crafted project file and gain unauthorized write access to the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsEcoStruxure Operator Terminal Expert: 3.1 SP1
External linkshttp://www.se.com/ww/en/download/document/SEVD-2020-133-04/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
