CVE-2020-28221 - Vulnerability Details

Vendors	Products
Schneider-electric	Ecostruxure Operator Terminal Expert Gp-4104g Gp-4104w Gp-4105g Gp-4105w Gp-4106g Gp-4106w Gp-4107g Gp-4107w Hmi Sto 501 Hmi Sto 511 Hmi Sto 512 Hmi Sto 531 Hmi Sto 532 Hmig3u Hmig3x Hmig5u Hmig5u2 Hmist6200 Hmist6400 Hmist6500 Hmist6600 Hmist6700 Pro-face Blue Sp-5400wa Sp-5500tp Sp-5500wa Sp-5600ta Sp-5600tp Sp-5600wa Sp-5660tp Sp-5700tp Sp-5700wc Sp-5800wc Sp-5b00 Sp-5b10 Sp-5b41 St-6200wa St-6400wa St-6500wa St-6600wa St-6700wa

Link	Providers
https://www.se.com/ww/en/download/document/SEVD-2021-012-01/

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "EcoStruxure\u2122 Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series", "vendor": "n/a", "versions": [{"status": "affected", "version": "EcoStruxure\u2122 Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series"}]}], "descriptions": [{"lang": "en", "value": "A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure\u2122 Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-25T17:08:37", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2020-28221", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EcoStruxure\u2122 Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series", "version": {"version_data": [{"version_value": "EcoStruxure\u2122 Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure\u2122 Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20: Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/", "refsource": "MISC", "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T16:33:58.933Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/"}]}]}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2020-28221", "datePublished": "2021-01-25T17:08:37", "dateReserved": "2020-11-05T00:00:00", "dateUpdated": "2024-08-04T16:33:58.933Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-20 (string)

description : CWE-20: Improper Input Validation (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-01-25T17:08:37 (string)

orgId : 076d1eb6-cfab-4401-b34d-6dfc2a413bdb (string)

shortName : schneider (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cybersecurity@schneider-electric.com (string)

ID : CVE-2020-28221 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series (string)

version : { »

version_data : [ »

0 : { »

version_value : EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-20: Improper Input Validation (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

refsource : MISC (string)

url : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T16:33:58.933Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 076d1eb6-cfab-4401-b34d-6dfc2a413bdb (string)

assignerShortName : schneider (string)

cveId : CVE-2020-28221 (string)

datePublished : 2021-01-25T17:08:37 (string)

dateReserved : 2020-11-05T00:00:00 (string)

dateUpdated : 2024-08-04T16:33:58.933Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "91DB915E-0D1C-40C9-A4D2-D078BE03F27C", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1a:*:*:*:*:*:*", "matchCriteriaId": "BACE1852-347B-4311-9CCB-D8FFDCD0FECA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:hmi_sto_501:-:*:*:*:*:*:*:*", "matchCriteriaId": "A65EC4B3-11C8-4D04-BC69-3DD258304B87", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmi_sto_511:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD340565-725B-4453-9B24-4C86644F9D34", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmi_sto_512:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C386B6A-3F2A-4F56-9651-FFD974EDB774", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmi_sto_531:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7FC9FA9-B98B-4C51-A349-9DF6FB36E1B6", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmi_sto_532:-:*:*:*:*:*:*:*", "matchCriteriaId": "E26C0B22-12A9-44CF-BFE4-AEC4D066ACCA", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmig3u:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFF2C9FF-6BE3-4016-91A1-3EDDF4BB1DFE", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmig3x:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9B4D538-DC2F-4DAE-A036-A577E509D1CF", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmig5u:-:*:*:*:*:*:*:*", "matchCriteriaId": "E72FE48D-3B73-48DA-BABE-F0871E118E7E", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmig5u2:-:*:*:*:*:*:*:*", "matchCriteriaId": "E881CC09-2083-4958-A08B-C6A1A6368368", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmist6200:-:*:*:*:*:*:*:*", "matchCriteriaId": "3BD84D5B-217A-4FF5-94E5-91541CA61EF5", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmist6400:-:*:*:*:*:*:*:*", "matchCriteriaId": "16C13321-9184-4081-A11A-8C427BB4BE71", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmist6500:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3290B53-034D-4DDB-AFA3-5D91A10725E1", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmist6600:-:*:*:*:*:*:*:*", "matchCriteriaId": "570DB15C-328D-42CD-B82C-ED8A817F74FC", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:hmist6700:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC6B0D00-4CA9-4012-92A8-0D0634FBB4BD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:pro-face_blue:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "954E2CC0-2CB2-47BE-89E2-E834435CB667", "vulnerable": true}, {"criteria": "cpe:2.3:a:schneider-electric:pro-face_blue:3.1:sp1a:*:*:*:*:*:*", "matchCriteriaId": "80985893-C9FE-44C0-B388-76B8CEA14DB6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:gp-4104g:-:*:*:*:*:*:*:*", "matchCriteriaId": "B273E19D-7E4C-4437-AB67-49CAF24FA352", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4104w:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7F327BA-197B-4BFA-9FE6-E40A3E7FED93", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4105g:-:*:*:*:*:*:*:*", "matchCriteriaId": "8750204E-2333-4163-A88A-7AC0D79B0B3D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4105w:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0D39C42-32BE-45DB-9590-0E382C76D0D8", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4106g:-:*:*:*:*:*:*:*", "matchCriteriaId": "F2EE3958-E7E2-4CA7-BBFB-3015EFAD957C", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4106w:-:*:*:*:*:*:*:*", "matchCriteriaId": "437A78A0-2D71-442F-A96F-BF34FC6E406C", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4107g:-:*:*:*:*:*:*:*", "matchCriteriaId": "91285194-9241-4B4C-9BC5-EDDEC769A191", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gp-4107w:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D7DD410-DC45-4E7C-AD92-B7F236376D21", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5400wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "43886AEE-C7EB-46CC-86FC-DA401BAED53A", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5500tp:-:*:*:*:*:*:*:*", "matchCriteriaId": "0F839018-F28F-42C9-A725-EA564B29BCA7", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5500wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "C9B7D645-5E75-4322-A725-5E87175CFB38", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5600ta:-:*:*:*:*:*:*:*", "matchCriteriaId": "DF5F2C5B-F295-429E-9176-B17F3A368001", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5600tp:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D9E6A3B-E4AD-404F-84BC-40A43E5B6190", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5600wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "6791B663-7EA9-46F4-A1B2-E0FA6892C02E", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5660tp:-:*:*:*:*:*:*:*", "matchCriteriaId": "99B18FDD-893B-449E-AA2F-17DFEC641450", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5700tp:-:*:*:*:*:*:*:*", "matchCriteriaId": "65029B55-0B79-41D0-A595-B52EF289608F", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5700wc:-:*:*:*:*:*:*:*", "matchCriteriaId": "AEE93DF3-238B-41A0-98A6-95C9198597CE", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5800wc:-:*:*:*:*:*:*:*", "matchCriteriaId": "08BD83A7-89E6-495A-9614-34036D973463", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5b00:-:*:*:*:*:*:*:*", "matchCriteriaId": "674CC67D-7FFD-45C4-8F55-3B88D9573A8B", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5b10:-:*:*:*:*:*:*:*", "matchCriteriaId": "F71C88DF-8F96-4CB1-8DB6-0AC4D518A316", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sp-5b41:-:*:*:*:*:*:*:*", "matchCriteriaId": "C57403D3-FBC8-4223-A46E-8AEAE0FFC555", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:st-6200wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FE1CEF1-B73A-43FC-9ED9-E3710C4C41B3", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:st-6400wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "5C96ACBC-B832-44AA-B36A-33EEA69CD963", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:st-6500wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "A24789BC-38C9-483B-9A99-A460D1ED41E1", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:st-6600wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "7AF5CB30-8F1D-4ECE-9AE7-60D0FDAD3FE5", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:st-6700wa:-:*:*:*:*:*:*:*", "matchCriteriaId": "37A233C5-3E7E-4911-AF51-7C8271E2747F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure\u2122 Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI."}, {"lang": "es", "value": "CWE-20: Se presenta una vulnerabilidad de Comprobaci\u00f3n Inapropiada de la Entrada en EcoStruxure\u2122 Operator Terminal Expert y Pro-face BLUE (detalles de la versi\u00f3n en la notificaci\u00f3n) que podr\u00eda causar una ejecuci\u00f3n de c\u00f3digo arbitraria cuando la funcionalidad Ethernet Download est\u00e1 habilitada en la HMI"}], "id": "CVE-2020-28221", "lastModified": "2024-11-21T05:22:30.077", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-01-26T18:15:47.600", "references": [{"source": "cybersecurity@se.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-01/"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "cybersecurity@se.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 91DB915E-0D1C-40C9-A4D2-D078BE03F27C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1a:*:*:*:*:*:* (string)

matchCriteriaId : BACE1852-347B-4311-9CCB-D8FFDCD0FECA (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:schneider-electric:hmi_sto_501:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A65EC4B3-11C8-4D04-BC69-3DD258304B87 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:schneider-electric:hmi_sto_511:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AD340565-725B-4453-9B24-4C86644F9D34 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:schneider-electric:hmi_sto_512:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C386B6A-3F2A-4F56-9651-FFD974EDB774 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:schneider-electric:hmi_sto_531:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C7FC9FA9-B98B-4C51-A349-9DF6FB36E1B6 (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:schneider-electric:hmi_sto_532:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E26C0B22-12A9-44CF-BFE4-AEC4D066ACCA (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:schneider-electric:hmig3u:-:*:*:*:*:*:*:* (string)

matchCriteriaId : EFF2C9FF-6BE3-4016-91A1-3EDDF4BB1DFE (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:schneider-electric:hmig3x:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F9B4D538-DC2F-4DAE-A036-A577E509D1CF (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:schneider-electric:hmig5u:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E72FE48D-3B73-48DA-BABE-F0871E118E7E (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:schneider-electric:hmig5u2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E881CC09-2083-4958-A08B-C6A1A6368368 (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:schneider-electric:hmist6200:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3BD84D5B-217A-4FF5-94E5-91541CA61EF5 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:schneider-electric:hmist6400:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 16C13321-9184-4081-A11A-8C427BB4BE71 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:schneider-electric:hmist6500:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B3290B53-034D-4DDB-AFA3-5D91A10725E1 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:schneider-electric:hmist6600:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 570DB15C-328D-42CD-B82C-ED8A817F74FC (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:schneider-electric:hmist6700:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DC6B0D00-4CA9-4012-92A8-0D0634FBB4BD (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:schneider-electric:pro-face_blue:3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 954E2CC0-2CB2-47BE-89E2-E834435CB667 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:schneider-electric:pro-face_blue:3.1:sp1a:*:*:*:*:*:* (string)

matchCriteriaId : 80985893-C9FE-44C0-B388-76B8CEA14DB6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4104g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B273E19D-7E4C-4437-AB67-49CAF24FA352 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4104w:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F7F327BA-197B-4BFA-9FE6-E40A3E7FED93 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4105g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8750204E-2333-4163-A88A-7AC0D79B0B3D (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4105w:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E0D39C42-32BE-45DB-9590-0E382C76D0D8 (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4106g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F2EE3958-E7E2-4CA7-BBFB-3015EFAD957C (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4106w:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 437A78A0-2D71-442F-A96F-BF34FC6E406C (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4107g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 91285194-9241-4B4C-9BC5-EDDEC769A191 (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:schneider-electric:gp-4107w:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0D7DD410-DC45-4E7C-AD92-B7F236376D21 (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5400wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 43886AEE-C7EB-46CC-86FC-DA401BAED53A (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5500tp:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0F839018-F28F-42C9-A725-EA564B29BCA7 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5500wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C9B7D645-5E75-4322-A725-5E87175CFB38 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5600ta:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DF5F2C5B-F295-429E-9176-B17F3A368001 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5600tp:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0D9E6A3B-E4AD-404F-84BC-40A43E5B6190 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5600wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6791B663-7EA9-46F4-A1B2-E0FA6892C02E (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5660tp:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 99B18FDD-893B-449E-AA2F-17DFEC641450 (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5700tp:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 65029B55-0B79-41D0-A595-B52EF289608F (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5700wc:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AEE93DF3-238B-41A0-98A6-95C9198597CE (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5800wc:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 08BD83A7-89E6-495A-9614-34036D973463 (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5b00:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 674CC67D-7FFD-45C4-8F55-3B88D9573A8B (string)

vulnerable : false (boolean)

}

19 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5b10:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F71C88DF-8F96-4CB1-8DB6-0AC4D518A316 (string)

vulnerable : false (boolean)

}

20 : { »

criteria : cpe:2.3:h:schneider-electric:sp-5b41:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C57403D3-FBC8-4223-A46E-8AEAE0FFC555 (string)

vulnerable : false (boolean)

}

21 : { »

criteria : cpe:2.3:h:schneider-electric:st-6200wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8FE1CEF1-B73A-43FC-9ED9-E3710C4C41B3 (string)

vulnerable : false (boolean)

}

22 : { »

criteria : cpe:2.3:h:schneider-electric:st-6400wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5C96ACBC-B832-44AA-B36A-33EEA69CD963 (string)

vulnerable : false (boolean)

}

23 : { »

criteria : cpe:2.3:h:schneider-electric:st-6500wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A24789BC-38C9-483B-9A99-A460D1ED41E1 (string)

vulnerable : false (boolean)

}

24 : { »

criteria : cpe:2.3:h:schneider-electric:st-6600wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7AF5CB30-8F1D-4ECE-9AE7-60D0FDAD3FE5 (string)

vulnerable : false (boolean)

}

25 : { »

criteria : cpe:2.3:h:schneider-electric:st-6700wa:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 37A233C5-3E7E-4911-AF51-7C8271E2747F (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. (string)

}

1 : { »

lang : es (string)

value : CWE-20: Se presenta una vulnerabilidad de Comprobación Inapropiada de la Entrada en EcoStruxure™ Operator Terminal Expert y Pro-face BLUE (detalles de la versión en la notificación) que podría causar una ejecución de código arbitraria cuando la funcionalidad Ethernet Download está habilitada en la HMI (string)

}

]

id : CVE-2020-28221 (string)

lastModified : 2024-11-21T05:22:30.077 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : COMPLETE (string)

baseScore : 9.3 (number)

confidentialityImpact : COMPLETE (string)

integrityImpact : COMPLETE (string)

vectorString : AV:N/AC:M/Au:N/C:C/I:C/A:C (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 10 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-01-26T18:15:47.600 (string)

references : [ »

0 : { »

source : cybersecurity@se.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://www.se.com/ww/en/download/document/SEVD-2021-012-01/ (string)

}

]

sourceIdentifier : cybersecurity@se.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : cybersecurity@se.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object