RCE in Schneider-Electric Andover Continuum 5720
CVE-2020-7480
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.015 (71.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Andover_continuum_5720
- Schneider-electric Andover_continuum_5720_firmware
- Schneider-electric Andover_continuum_5740
- Schneider-electric Andover_continuum_5740_firmware
- Schneider-electric Andover_continuum_9200
- Schneider-electric Andover_continuum_9200_firmware
- Schneider-electric Andover_continuum_9680
- Schneider-electric Andover_continuum_9680_firmware
- Schneider-electric Andover_continuum_9702
- Schneider-electric Andover_continuum_9702_firmware
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7480?
- CVE-2020-7480 is a critical-severity vulnerability in Schneider-Electric Andover Continuum 5720, classified under Code Injection. CVSS score: 9.8/10. Published 2020-03-23.
- How severe is CVE-2020-7480?
- Critical severity. CVSS v3 base score is 9.8 out of 10.