{"vulnerability": "cve-2020-7523", "sightings": [{"uuid": "bb5ca9e3-be46-48fc-be12-23e6f12f49a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7523", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1730", "content": "#SCADA_Security\n1. Performing SQL Backflips to Achieve Code Execution on Schneider Electric\u2019s EcoStruxure Operator Terminal Expert, ver.3.1.100.267 (SP1) and prior (PoC)\nhttps://www.zerodayinitiative.com/blog/2020/9/9/performing-sql-backflips-to-achieve-code-execution-on-schneider-electrics-ecostruxure-operator-terminal-expert-at-pwn2own-miami-2020\n2. CVE-2020-7523:\nAbusing a shared memory for getting a LPE on the Schneider Electric Modbus Serial Driver (PoC)\nhttps://airbus-cyber-security.com/abusing-a-shared-memory-for-getting-a-local-privilege-escalation-on-the-schneider-electric-modbus-serial-driver-cve-2020-7523", "creation_timestamp": "2020-12-23T16:40:23.000000Z"}, {"uuid": "e648f7b7-89c8-4419-9880-2a3452b6f021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-7523", "type": "seen", "source": "https://t.me/cissp/1528", "content": "\ud83d\ude01\nPerforming SQL Backflips to Achieve Code Execution on Schneider Electric\u2019s EcoStruxure Operator Terminal Expert, ver.3.1.100.267 (SP1) and prior (PoC)\n\nThis post describes a chain of two vulnerabilities found by Claroty Research\u2019s Amir Preminger and Sharon Brizinov. These bugs were put to use in ZDI's\u00a0Pwn2Own Miami\u00a0competition in January. The vulnerabilities described are present in Schneider Electric\u2019s EcoStruxure Operator Terminal Expert, version v3.1.100.267 (SP 1) and prior (formerly known as Vijeo XD).\u00a0\nThe default configuration is exploitable by luring a victim into opening (double-clicking) an EcoStruxure Operator Terminal Expert software project file. The exploit will trigger code execution in the context of the application. The attack relies on chaining the two vulnerabilities described below. This blog describes the vulnerability details in the order they were discovered, followed by a list of the exploitation steps necessary to chain them and achieve command execution. Here\u2019s a quick video of these bugs in action:\n\nTechnical Details\nEcoStruxure Control Terminal Expert is a software environment for designing graphical user interfaces for Human Machine Interface (HMI) devices. These are user interfaces used to control the operation of programmable logic controllers (PLCs) in industrial deployments.\n\nConclusion\nWe took advantage of the way EcoStruxure Operator Terminal Expert reads a given project file, and by performing some SQL backflips, we were able to lead the software into loading our own provided DLL, producing arbitrary code execution upon opening a project file. Schneider Electric\u00a0patched\u00a0these bugs and assigned them\u00a0CVE-2020-7494 and CVE-2020-7496.\nhttps://www.zerodayinitiative.com/blog/2020/9/9/performing-sql-backflips-to-achieve-code-execution-on-schneider-electrics-ecostruxure-operator-terminal-expert-at-pwn2own-miami-2020\n\n+ \ud83d\ude00\nCVE-2020-7523:\nAbusing a shared memory for getting a LPE on the Schneider Electric Modbus Serial Driver (PoC)\nhttps://airbus-cyber-security.com/abusing-a-shared-memory-for-getting-a-local-privilege-escalation-on-the-schneider-electric-modbus-serial-driver-cve-2020-7523/", "creation_timestamp": "2026-09-01T17:01:12.267772Z"}]}