CVE-2020-7523
CVSS V2 Medium 4.4
CVSS V3 High 7.8
Description
Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Overview
- CVE ID
- CVE-2020-7523
- Assigner
- cybersecurity@se.com
- Vulnerability Status
- Analyzed
- Published Version
- 2020-08-31T17:15:12
- Last Modified Date
- 2021-06-04T14:16:02
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:schneider-electric:modbus_driver_suite:*:*:*:*:*:*:*:* | 1 | OR | 14.15.0.0 | |
| cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:x86:* | 1 | OR | 2.20_ie_30 | |
| cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:x64:* | 1 | OR | 3.20_ie_30 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:M/Au:N/C:P/I:P/A:P
- Access Vector
- LOCAL
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 4.4
- Severity
- MEDIUM
- Exploitability Score
- 3.4
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- HIGH
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- CHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7.8
- Base Severity
- HIGH
- Exploitability Score
- 1.1
- Impact Score
- 6
References
| Reference URL | Reference Tags |
|---|---|
| https://www.se.com/ww/en/download/document/SEVD-2020-224-01/ | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-7523 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7523 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:13:36 | Added to TrackCVE | |||
| 2022-12-04 21:46:02 | cybersecurity@schneider-electric.com | cybersecurity@se.com | CVE Assigner | updated |
| 2022-12-04 21:46:02 | 2020-08-31T17:15Z | 2020-08-31T17:15:12 | CVE Published Date | updated |
| 2022-12-04 21:46:02 | 2021-06-04T14:16:02 | CVE Modified Date | updated | |
| 2022-12-04 21:46:02 | Analyzed | Vulnerability Status | updated |