CVE:CVE-2020-7546
CNNVD:CNNVD-202012-019
Schneider Electric EcoStruxure Power Monitoring Expert等都是法国施耐德（Schneider Electric）公司的产品。Schneider Electric EcoStruxure Power Monitoring Expert是一个用于物联网环境中进行配电监控的设备。Schneider Electric Energy Expert是一个用于物联网环境中进行配电管理的设备。Schneider Electric Power Manager是一个用于物联网环境中进行配电管理的设备。
EcoStruxure和SmartStruxure和Power Monitoring和SCADA Software存在跨站脚本漏洞，该漏洞允许攻击者可利用该漏洞在访问受影响网页时代表授权用户执行操作。
solution:Upgrade schneider-electric ecostruxure_energy_expert to a higher version than 2.0,and avoid the version 2.0; Upgrade schneider-electric ecostruxure_power_monitoring_expert to a higher version than 7.0,8.0,9.0,and avoid the version 7.0,8.0,9.0; Upgrade schneider-electric power_manager to a higher version than 1.1,1.2,1.3,and avoid the version 1.1,1.2,1.3; Upgrade schneider-electric powerscada_expert_with_advanced_reporting_and_dashboards to a higher version than 8.0,and avoid the version 8.0; Upgrade schneider-electric powerscada_operation_with_advanced_reporting_and_dashboards to a higher version than 9.0,and avoid the version 9.0