CVE-2020-7523

EUVD-2020-28648
Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Affected Products (NVD)
VendorProductVersion
schneider-electricmodbus_driver_suite
𝑥
< 14.15.0.0
schneider-electricmodbus_serial_driver
𝑥
< 2.20_ie_30
schneider-electricmodbus_serial_driver
𝑥
< 3.20_ie_30
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.se.com/ww/en/download/document/SEVD-2020-224-01/
https://www.se.com/ww/en/download/document/SEVD-2020-224-01/