CVE-2020-7532

HIGH

Schneider-electric Scadapack X70 Secu... - Insecure Deserialization

Title source: rule

Description

A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could allow arbitrary code execution when an attacker builds a custom .SDB file containing a malicious serialized buffer.

References (1)

[Vendor Advisory] https://www.se.com/ww/en/download/document/SEVD-2020-252-01/

Scores

CVSS v3 7.8

EPSS 0.0043

EPSS Percentile 62.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

schneider-electric/scadapack_x70_security_administrator < 1.2.0

Timeline

Published Sep 16, 2020

Tracked Since Feb 18, 2026