Schneider Electric Software Update Utility vulnerabilities

3 CVEs affecting Schneider Electric Software Update Utility, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7520, published 2020-07-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0655, published 2013-01-21. High severity, CVSS 9.3. EPSS: 2.9% chance of exploitation in the next 30 days. The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and…
CVE-2018-7799, published 2018-11-02. High severity, CVSS 7.8. EPSS: 2.8% chance of exploitation in the next 30 days. A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbitrary code on the targeted system when…
CVE-2020-7520, published 2020-07-23. Medium severity, CVSS 4.7. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on…