Lucene search

[email protected]NVD:CVE-2023-25550

HistoryApr 18, 2023 - 9:15 p.m.

CVE-2023-25550

2023-04-1821:15:08

CWE-94

[email protected]

web.nvd.nist.gov

cwe-94

remote code execution

hostname parameter

exploit

struxureware data center expert

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.9%

JSON

A CWE-94: Improper Control of Generation of Code (‘Code Injection’) vulnerability exists that
allows remote code execution via the “hostname” parameter when maliciously crafted hostname
syntax is entered.

Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)

Affected configurations

NVD

Node

schneider-electricstruxureware_data_center_expertRange≤7.9.2

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.9%

JSON

Related for NVD:CVE-2023-25550

prion1 cve1 cvelist1