Schneider Electric Scadapack 7x Remote Connect vulnerabilities

4 CVEs affecting Schneider Electric Scadapack 7x Remote Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7531, published 2020-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-7528, published 2020-09-16. High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days. A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code execution when an attacker builds a custom .PRJ…
CVE-2020-7530, published 2020-09-16. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to executable code folders.
CVE-2020-7529, published 2020-09-16. Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place…
CVE-2020-7531, published 2020-09-16. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place executables in a specific folder and run code whenever…