CVE-2020-7500 SQL injection in U.motion Servers and Touch Panels (affected versions listed in the security notification)
SQL injection in U.motion Servers allows attackers to execute arbitrary code via malicious commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7500?
CVE-2020-7500 is a critical SQL injection vulnerability in U.motion Servers and Touch Panels (affected versions listed in the security notification), published on 16 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.
Weakness: CWE-89
Which versions are affected by CVE-2020-7500?
It affects 6 products.
Products include Schneider-Electric Mtn6260-0310 Firmware, Schneider-Electric Mtn6260-0315 Firmware, Schneider-Electric Mtn6260-0410 Firmware, Schneider-Electric Mtn6260-0415 Firmware, Schneider-Electric Mtn6501-0001 Firmware, Schneider-Electric Mtn6501-0002 Firmware.
How do I fix CVE-2020-7500?
No fix has been published for CVE-2020-7500 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-7500 being exploited?
There is no known exploitation of CVE-2020-7500 in the wild and no public exploit code.
Other vulnerabilities in U.motion Servers and Touch Panels (affected versions listed in the security notification)
Sources
Also known as GHSA-pvq3-jwgr-p6qw.