Sign-up

ID

VAR-202008-1032


CVE

CVE-2020-7523


TITLE

Schneider Electric Modbus Privilege management vulnerability in serial driver

Trust: 0.8

sources: JVNDB: JVNDB-2020-010515

DESCRIPTION

Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. (DoS) It may be put into a state. Schneider Electric Modbus Serial Driver is a serial driver of French Schneider Electric (Schneider Electric)

Trust: 1.71

sources: NVD: CVE-2020-7523 // JVNDB: JVNDB-2020-010515 // VULHUB: VHN-185648

AFFECTED PRODUCTS

vendor:schneider electricmodel:modbus serial driverscope:ltversion:2.20_ie_30

Trust: 1.0

vendor:schneider electricmodel:modbus driver suitescope:ltversion:14.15.0.0

Trust: 1.0

vendor:schneider electricmodel:modbus serial driverscope:ltversion:3.20_ie_30

Trust: 1.0

vendor:schneider electricmodel:modbus driver suitescope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modbus serial driverscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-010515 // NVD: CVE-2020-7523

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-7523
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-010515
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202008-1468
value: HIGH

Trust: 0.6

VULHUB: VHN-185648
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-7523
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-010515
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-185648
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-7523
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.1
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-010515
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-185648 // JVNDB: JVNDB-2020-010515 // CNNVD: CNNVD-202008-1468 // NVD: CVE-2020-7523

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.9

sources: VULHUB: VHN-185648 // JVNDB: JVNDB-2020-010515 // NVD: CVE-2020-7523

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202008-1468

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202008-1468

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-010515

PATCH
title:SEVD-2020-224-01url:https://www.se.com/ww/en/download/document/SEVD-2020-224-01/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2020-010515

EXTERNAL IDS
db:NVDid:CVE-2020-7523
Trust: 2.5
db:SCHNEIDERid:SEVD-2020-224-01
Trust: 1.7
db:JVNDBid:JVNDB-2020-010515
Trust: 0.8
db:CNNVDid:CNNVD-202008-1468
Trust: 0.7
db:VULHUBid:VHN-185648
Trust: 0.1
sources:
            
            
            VULHUB: VHN-185648 // 
            
            
            
            JVNDB: JVNDB-2020-010515 // 
            
            
            
            CNNVD: CNNVD-202008-1468 // 
            
            
            
            NVD: CVE-2020-7523

REFERENCES
url:https://www.se.com/ww/en/download/document/sevd-2020-224-01/
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2020-7523
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-7523
Trust: 0.8
sources:
            
            
            VULHUB: VHN-185648 // 
            
            
            
            JVNDB: JVNDB-2020-010515 // 
            
            
            
            CNNVD: CNNVD-202008-1468 // 
            
            
            
            NVD: CVE-2020-7523

SOURCES
db:VULHUBid:VHN-185648
db:JVNDBid:JVNDB-2020-010515
db:CNNVDid:CNNVD-202008-1468
db:NVDid:CVE-2020-7523

LAST UPDATE DATE
2024-11-23T21:59:03.293000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-185648date:2021-06-04T00:00:00
db:JVNDBid:JVNDB-2020-010515date:2021-01-25T09:01:14
db:CNNVDid:CNNVD-202008-1468date:2021-08-12T00:00:00
db:NVDid:CVE-2020-7523date:2024-11-21T05:37:18.530

SOURCES RELEASE DATE
db:VULHUBid:VHN-185648date:2020-08-31T00:00:00
db:JVNDBid:JVNDB-2020-010515date:2021-01-25T09:01:14
db:CNNVDid:CNNVD-202008-1468date:2020-08-31T00:00:00
db:NVDid:CVE-2020-7523date:2020-08-31T17:15:12.373