Lucene search

SchneiderCVE-2024-0865

HistoryJun 12, 2024 - 6:15 p.m.

CVE-2024-0865

2024-06-1218:15:10

CWE-798

schneider

web.nvd.nist.gov

cve-2024-0865

use of hard-coded credentials

local privilege escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

16.7%

JSON

CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege
escalation when logged in as a non-administrative user.

Affected configurations

Nvd

Node

schneider-electricecostruxure_it_gatewayRange<1.21.0

VendorProductVersionCPE
schneider-electricecostruxure_it_gateway*cpe:2.3:a:schneider-electric:ecostruxure_it_gateway:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	ecostruxure_it_gateway	*	cpe:2.3:a:schneider-electric:ecostruxure_it_gateway::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "EcoStruxure IT Gateway",
    "vendor": "Schneider Electric",
    "versions": [
      {
        "status": "affected",
        "version": "1.20.x and prior"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-03.pdf

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

16.7%

JSON

Related for CVE-2024-0865