Auth bypass in Schneider-Electric Mtn6260-0310
CVE-2020-7499
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause unauthorized access when a low privileged user makes unauthorized changes.
Vulnerability class: Broken Access Control
EPSS: 0.008 (52.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Schneider-electric Mtn6260-0310
- Schneider-electric Mtn6260-0310_firmware
- Schneider-electric Mtn6260-0315
- Schneider-electric Mtn6260-0315_firmware
- Schneider-electric Mtn6260-0410
- Schneider-electric Mtn6260-0410_firmware
- Schneider-electric Mtn6260-0415
- Schneider-electric Mtn6260-0415_firmware
- Schneider-electric Mtn6501-0001
- Schneider-electric Mtn6501-0001_firmware
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7499?
- CVE-2020-7499 is a medium-severity vulnerability in Schneider-Electric Mtn6260-0310, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2020-06-16.
- How severe is CVE-2020-7499?
- Medium severity. CVSS v3 base score is 6.5 out of 10.