Improper Input Validation in PowerChute Business Edition by Schneider Electric
CVE-2020-7526

8.8HIGH

Key Information:

Vendor

Apc

Status
Powerchute Business Edition Software V9.0.x And Earlier
Vendor
CVE Published:
31 August 2020

What is CVE-2020-7526?

An improper input validation vulnerability exists in PowerChute Business Edition, versions up to 9.0.x, which could allow an attacker to execute arbitrary code remotely. This security flaw arises when scripts are executed during a shutdown event, posing risks to the integrity and confidentiality of the system. Implementing security best practices and applying potential patches is crucial to mitigate such risks.

Affected Version(s)

PowerChute Business Edition software V9.0.x and earlier PowerChute Business Edition software V9.0.x and earlier

References

https://www.se.com/ww/en/download/document/SEVD-2020-224-05/
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.