Vulnerabilities fixed in Schneider Electric EcoStruxture components

🗓️ 13 Jul 2023 00:00:00Reported by NCSCType

Schneider Electric fixed vulnerabilities in StruxtureWare and EcoStruxture OPC UA Server Expert; authenticated attackers could access data.

Reporter	Title	Published	Views	Family All 48
BDU FSTEC	The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, relates to the possibility of embedding commands that allow a intruder to execute arbitrary code.	11 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from the lack of measures taken to protect the SQL query structure. This allows attackers to modify or delete any content they desire.	17 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from improper code generation. This allows a perpetrator to execute arbitrary code.	3 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from improper code generation. This allows a perpetrator to execute arbitrary code.	3 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the EcoStruxure OPC UA Server Expert software, a software tool for managing industrial processes, arises from incorrect restrictions on XML references to external objects. This allows attackers to access confidential information.	3 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-37196	12 Jul 202312:35	–	circl
Circl	CVE-2023-37200	12 Jul 202312:41	–	circl
CNNVD	Schneider Electric EcoStruxure OPC UA Server Expert 代码问题漏洞	12 Jul 202300:00	–	cnnvd
CNNVD	Schneider Electric StruxureWare Data Center Expert 代码注入漏洞	12 Jul 202300:00	–	cnnvd
CNNVD	Schneider Electric StruxureWare Data Center Expert SQL注入漏洞	12 Jul 202300:00	–	cnnvd

13 Jul 2023 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18.8

EPSS0.00752

SSVC