CVE-2020-7492 Information disclosure in GP-Pro EX V1.00 to V4.09.100
Attackers can observe passwords during entry in GP-Pro EX HMI software due to lack of masking, potentially leading to credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7492?
CVE-2020-7492 is a medium-severity vulnerability in GP-Pro EX V1.00 to V4.09.100, published on 16 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded.
Weakness: CWE-521
Which versions are affected by CVE-2020-7492?
It affects 1 product.
Products include Schneider-Electric Gp-Pro Ex Firmware.
How do I fix CVE-2020-7492?
No fix has been published for CVE-2020-7492 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7492 being exploited?
There is no known exploitation of CVE-2020-7492 in the wild and no public exploit code.
Sources
Also known as GHSA-jj8m-5r73-pqj4.