SB2020111109 - Multiple vulnerabilities in Schneider Electric PLC Simulator for EcoStruxure Control Expert

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020111109

SB2020111109 - Multiple vulnerabilities in Schneider Electric PLC Simulator for EcoStruxure Control Expert

Published: November 11, 2020 Updated: December 14, 2020

Security Bulletin ID SB2020111109
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2020-7538)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request over Modbus and cause denial of service condition.


2) Download of code without integrity check (CVE-ID: CVE-2020-28213)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading updates. A remote authenticated attacker can send specially crafted requests over Modbus and execute arbitrary commands on the target system. 


3) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2020-28212)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to gain access to the system.

The vulnerability exists due to the authentication mechanism has no brute-force prevention. A remote attacker can launch a brute-force authentication attack and cause unauthorized command execution.


4) Improper Authorization (CVE-ID: CVE-2020-28211)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/U:Clear


The vulnerability allows a local user to bypass authorization checks.

The vulnerability exists due to improper authorization check. A local administrator can bypass authentication when overwriting memory using a debugger.


5) Stack-based buffer overflow (CVE-ID: CVE-2020-7559)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Modbus message-processing functionality. A remote unauthenticated attacker can send a specially crafted request, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References