Log in Start free

Vulnerability · Published Dec 1, 2020 · Assigned by schneider

CVE-2020-7546

Medium 5.4

In plain English

A medium-severity cross-site scripting in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.

Affected products (as reported)

VendorProductVersions
n/a EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)

Weakness: CWE-79

References