{"containers": {"cna": {"affected": [{"product": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) ", "vendor": "n/a", "versions": [{"status": "affected", "version": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions)"}]}], "descriptions": [{"lang": "en", "value": "A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-494", "description": "CWE-494: Download of Code Without Integrity Check", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-19T21:03:54", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2020-28213", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) ", "version": {"version_data": [{"version_value": "PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-494: Download of Code Without Integrity Check"}]}]}, "references": {"reference_data": [{"name": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07", "refsource": "MISC", "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}]}}}}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2020-28213", "datePublished": "2020-11-19T21:03:54", "dateReserved": "2020-11-05T00:00:00", "dateUpdated": "2020-11-19T21:03:54", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*", "matchCriteriaId": "18E8CCC1-A467-4FEF-964D-8481EAE892EC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxure\u00aa Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus."}, {"lang": "es", "value": "CWE-494: Se presenta una vulnerabilidad Descarga de C\u00f3digo Sin Comprobaci\u00f3n de Integridad en el Simulador de PLC en EcoStruxure\u00aa Control Expert (ahora Unity Pro) (todas las versiones) que podr\u00eda causar la ejecuci\u00f3n de comandos no autorizados cuando se env\u00eda peticiones especialmente dise\u00f1adas mediante Modbus"}], "id": "CVE-2020-28213", "lastModified": "2022-01-31T19:33:27.457", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-19T22:15:13.597", "references": [{"source": "cybersecurity@se.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-07"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "cybersecurity@se.com", "type": "Primary"}]}

{}