Schneider Electric Easergy T300
The affected product is vulnerable to a missing authentication for critical function vulnerability, which may allow an attacker to expose information, cause a denial-of-service condition, and remotely execute arbitrary code.CVE-2020-7561 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H). The affected product is vulnerable to a missing authorization vulnerability, which may allow an attacker to gain access to sensitive information, cause a denial-of-service condition, and remotely execute arbitrary code when access control checks are not applied consistently.CVE-2020-28215 has been assigned to this vulnerability. A CVSS v3 base score of 7.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H). The affected product is vulnerable to a missing encryption of sensitive data vulnerability, which may allow an attacker to read network traffic over HTTP protocol.CVE-2020-28216 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The affected product is vulnerable to a missing encryption of sensitive data vulnerability, which may allow an attacker to read network traffic over IEC60870-5-104 protocol.CVE-2020-28217 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L). The affected product is vulnerable due to an improper restriction of rendered UI layers or frames vulnerability, which may allow an attacker to trick a user into initiating an unintended action.CVE-2020-28218 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L).