Lucene search

[email protected]CVE-2022-32747

HistoryJan 30, 2023 - 11:15 p.m.

CVE-2022-32747

2023-01-3023:15:11

CWE-290

[email protected]

web.nvd.nist.gov

cve-2022-32747

cwe-290

authentication bypass

spoofing

ecostruxure cybersecurity admin expert

nvd

8.1 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

4.8 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

14.3%

JSON

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)

CPENameOperatorVersion
schneider-electric:ecostruxure_cybersecurity_admin_expertschneider-electric ecostruxure cybersecurity admin expertlt2.4
schneider-electric:ecostruxure_cybersecurity_admin_expertschneider-electric ecostruxure cybersecurity admin experteq2.2
schneider-electric:ecostruxure_cybersecurity_admin_expertschneider-electric ecostruxure cybersecurity admin experteq-

CPE	Name	Operator	Version
schneider-electric:ecostruxure_cybersecurity_admin_expert	schneider-electric ecostruxure cybersecurity admin expert	lt	2.4
schneider-electric:ecostruxure_cybersecurity_admin_expert	schneider-electric ecostruxure cybersecurity admin expert	eq	2.2
schneider-electric:ecostruxure_cybersecurity_admin_expert	schneider-electric ecostruxure cybersecurity admin expert	eq	-

References

download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf

8.1 High

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

4.8 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

14.3%

JSON

Related for CVE-2022-32747

prion1