Security readout for executives and security teams
Plain-English summary
This is a local Windows privilege-escalation risk in Schneider Electric EcoStruxure Building Operation installers. It matters mainly when the software was installed in a non-secure location where ordinary local users can write inside the Connect Agent service path. Default administrator-protected installs are described as not exposed.
Executive priority
Treat as moderate priority unless affected systems are installed in weakly protected directories or have many local users. For building operations environments, prioritize validation because local privilege escalation can increase operational risk after initial access.
Technical view
CVE-2020-28209 is a CWE-428 unquoted search path issue affecting Enterprise Server installer V1.9-V3.1 and Enterprise Central installer V2.0-V3.1. A local Windows user with write access to at least one subfolder in the Connect Agent service binary path could gain the privilege of the user who started the service.
Likely exposure
Exposure appears limited to affected Windows installations placed outside the default administrator-protected location, or where filesystem permissions allow local users to write into relevant service path subfolders.
Exploitation context
The bundle does not identify active exploitation, and the CVE is not marked CISA KEV. The attack requires local Windows access plus write permission in a specific service path location, so this is not described as a remote compromise vector.
Researcher notes
The provided sources do not include CVSS, confirmed exploitation, or a quoted fixed version. Analysis is therefore constrained to affected installer ranges, local-access prerequisites, CWE-428 behavior, and the vendor note that default administrator-protected installs are not valid exposure.
Mitigation direction
- Inventory affected EcoStruxure Building Operation Enterprise Server and Enterprise Central versions.
- Confirm installations use administrator-protected directories, not writable shared or user-controlled paths.
- Restrict write permissions on Connect Agent service path subfolders to trusted administrators only.
- Review Schneider Electric advisory SEVD-2020-315-04 for vendor-specific remediation guidance.
- Prioritize remediation where shared workstations or broad local user access exist.
Validation and detection
- Identify Windows hosts running the affected Enterprise Server or Enterprise Central installer versions.
- Check whether the application is installed outside the default administrator-protected location.
- Review Connect Agent service binary path permissions for user-writable subfolders.
- Confirm ordinary local users cannot write anywhere along relevant service path subfolders.
- Document any non-secure installations for remediation tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-28209 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.se.com/ww/en/download/document/SEVD-2020-315-04/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.