Open redirect in Schneider Electric Software Update V2.4.0 and prior.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Schneider Electric Software Update (SESU) V2.4.0 and prior. | Schneider Electric Software Update (SESU) V2.4.0 and prior. | — | No fix listed | CNA |
- Schneider Electric Software Update (SESU) V2.4.0 and prior. Vendor— Affected Schneider Electric Software Update (SESU) V2.4.0 and prior. Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:software_update_utility:*:*:*:*:*:*:*:* | up to 2.4.0 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:software_update_utility:*:*:*:*:*:*:*:* Versions up to 2.4.0 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7520
- 2026-10-03 Alias added: GHSA-392j-2p2c-c7m3
References
More Schneider Electric Software Update Utility vulnerabilities
- TI-2013-00548 The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not… CVSS 2.0HIGH 9.3
- TI-2018-05641 Uncontrolled search path in Schneider Electric Software Update , all versions prior to… CVSS 3.0HIGH 7.8
Sources
- CVE-2020-7520 · CVE Program
- CVE-2020-7520 · NVD
- FIRST EPSS
- GHSA-392j-2p2c-c7m3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences