SRC-2020-0010 : Schneider Electric EcoStruxure Operator Terminal Expert Hardcoded Cryptographic Key Information Disclosure Vulnerability

CVE ID:

N/A

CVSS Score:

4.0, (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Vendors:

Schneider Electric

Affected Products:

EcoStruxure Operator Terminal Expert

Vulnerability Details:

This vulnerability allows local attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Operator Terminal Expert. Local access to project files is required to exploit this vulnerability.

The specific flaw exists within the managed code. A hardcoded encryption key allows any user who accesses the encrypted databases inside of project files to reveal the plain-text sensitive content of those database files.

Vendor Response:

Schneider Electric has issued an update to correct this vulnerability. More details can be found at:
https://download.schneider-electric.com/files?p_Archive_Name=Installation_File_v3.1_SP1.zip

Disclosure Timeline:

  • 2020-02-18 – Public release of advisory

Proof of Concept:

/pocs/src-2020-0010.py.txt

Credit:

This vulnerability was discovered by Chris Anastasio (muffin) and Steven Seeley (mr_me) of Incite Team