Medium severity · published Dec 17, 2018
CVE-2018-7797
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions),…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure Power Monitoring Expert (PME) v9.0, EcoStruxure Energy Expert v2.0, and EcoStruxure Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module which could cause a phishing attack when redirected to a malicious site.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
Ecostruxure Energy Expert · Schneider-electric
1.3; 2.0 · source: NVD
EP
Ecostruxure Power Monitoring Expert · Schneider-electric
8.2; 9.0 · source: NVD
EP
Ecostruxure Power Scada Operation · Schneider-electric
8.2; 9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7797
Third Party Advisory
http://www.securityfocus.com/bid/106277
Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2018-347-01/
More from Ecostruxure Energy Expert
8.8
CVE-2020-7547
A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)…
7.2
CVE-2020-7545
A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)…
5.4
CVE-2020-7546
A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security…