Vulnerability in Schneider-Electric Ecostruxure Geo Scada Expert 2019
CVE-2020-28219
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.
EPSS: 0.003 (23.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Ecostruxure_geo_scada_expert_2019
- Schneider-electric Ecostruxure_geo_scada_expert_2020
- N/a Ecostruxure Geo Scada Expert 2019 (Original Release And Monthly Updates To September 2020, From 81.7268.1 81.7578.1) 2020 83.7551.1 83.7578.1) — versions EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1)
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-28219?
- CVE-2020-28219 is a high-severity vulnerability in Schneider-Electric Ecostruxure Geo Scada Expert 2019, classified under Insufficiently Protected Credentials. CVSS score: 7.8/10. Published 2020-12-11.
- How severe is CVE-2020-28219?
- High severity. CVSS v3 base score is 7.8 out of 10.