CVE-2020-7523

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-31 · updated 2026-06-17
Weakness: CWE-269

Description

Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected products

Schneider-Electric Modbus Driver Suite: before 14.15.0.0 — fixed in 14.15.0.0
Schneider-Electric Modbus Serial Driver: before 2.20_ie_30; before 3.20_ie_30 — fixed in 2.20_ie_30, 3.20_ie_30

How to fix

Upgrade to a fixed version: Schneider-Electric Modbus Driver Suite 14.15.0.0; Schneider-Electric Modbus Serial Driver 2.20_ie_30, 3.20_ie_30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-7523 or the next vulnerability affects your stack