{"containers": {"cna": {"affected": [{"product": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) ", "vendor": "n/a", "versions": [{"status": "affected", "version": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions)"}]}], "descriptions": [{"lang": "en", "value": "A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "A CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-19T21:03:37", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2020-28211", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) ", "version": {"version_data": [{"version_value": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "A CWE-863: Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07", "refsource": "MISC", "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}]}}}}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2020-28211", "datePublished": "2020-11-19T21:03:37", "dateReserved": "2020-11-05T00:00:00", "dateUpdated": "2020-11-19T21:03:37", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*", "matchCriteriaId": "18E8CCC1-A467-4FEF-964D-8481EAE892EC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger."}, {"lang": "es", "value": "CWE-863: Se presenta una vulnerabilidad Autorizaci\u00f3n Incorrecta en Simulador de PLC en EcoStruxure\u00aa Control Expert (ahora Unity Pro) (todas las versiones) que podr\u00eda causar una omisi\u00f3n de la autenticaci\u00f3n cuando se sobrescribe la memoria usando un depurador"}], "id": "CVE-2020-28211", "lastModified": "2022-01-31T19:33:27.443", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-19T22:15:13.410", "references": [{"source": "cybersecurity@se.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cybersecurity@se.com", "type": "Primary"}]}

{}