CVE-2022-32748
8.3 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.3%
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)
Affected configurations
CNA Affected
[
{
"vendor": "Schneider Electric",
"product": "EcoStruxure™ Cybersecurity Admin Expert (CAE)",
"versions": [
{
"version": "All",
"status": "affected",
"lessThan": "2.2",
"versionType": "custom"
}
]
}
]Related
8.3 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.3%