CVE-2020-28221

Severity CVSS v4.0:
Pending analysis
Type:
CWE-20 Input Validation
Publication date:
26/01/2021
Last modified:
12/02/2021

Description

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1a:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmi_sto_501:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmi_sto_511:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmi_sto_512:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmi_sto_531:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmi_sto_532:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmig3u:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmig3x:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmig5u:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmig5u2:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmist6200:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmist6400:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmist6500:-:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:hmist6600:-:*:*:*:*:*:*:*


References to Advisories, Solutions, and Tools