CVE-2023-25547: Incorrect Authorization

A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-27976: Exposure of Resource to Wrong Sphere

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert V15.1 and above...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. An access control error vulnerability...

Schneider Electric StruxureWare Data Center Expert 跨站脚本漏洞

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. A cross-site scripting vulnerability...

CVE-2023-1548: Improper Privilege Management

A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert V15.1 and above...

CVE-2023-25551: Improper Neutralization of Input During Web Page Generation

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

Schneider Electric StruxureWare Data Center Expert 代码注入漏洞

Schneider Electric StruxureWare Data Center Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security, and environment. A code injection vulnerability exists i...

PT-2023-2948 · Schneider Electric · Ecostruxure Control Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions 15.1 and above Description: The issue is related to improper privilege management, which could allow a local user to perform a denial of service through the console server service. This is due to insufficie...

PT-2023-2553 · Schneider Electric · Ecostruxure Control Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions 15.1 and above Description: A vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. This issue is related to insufficient...

Expert-Led Webinar: Learn Proven Strategies to Secure Your Identity Perimeter

The stakes are high when it comes to cybersecurity. No longer are we dealing with unskilled hackers trying to break into corporate systems with brute force. Today, cybercriminals are using highly sophisticated methods like social engineering, spear phishing, and BEC to target users directly and l...

Akamai Managed Security Service: New Expert Help to Protect from Attacks

...

The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert HMI terminals and the SCADA Pro-face BLUE software allows a perpetrator to execute arbitrary codes.

The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert and the SCADA Pro-face BLUE software is related to improper bypassing of a limited catalog. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert HMI terminals and the SCADA Pro-face BLUE software allows a perpetrator to execute arbitrary codes.

The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert HMI terminals and the SCADA Pro-face BLUE software is related to improper project conversion. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Security Bulletin: IBM Administration Runtime Expert for i is vulnerable to attacker obtaining sensitive information due to Java string processing in IBM Toolbox for Java (CVE-2022-43928)

Summary IBM Administration Runtime Expert for i uses the IBM Toolbox for Java to access IBM i interfaces. IBM Toolbox for Java could allow sensitive information stored as Java strings to be obtained by an attacker as described in the vulnerability details section. IBM Administration Runtime Exper...

The vulnerabilities of the programming software for PLCs (programmable logic controllers), the configuration software SCADAPack RemoteConnect, and the automation system for technological processes EcoStruxure Process Expert allow a intruder to gain unauthorized access to project files.

The vulnerabilities of the programming software for PLCs programmable logic controllers, the configuration software SCADAPack RemoteConnect, and the automation system for technological processes EcoStruxure Process Expert are related to insufficient protection of registration data. Exploiting the...

The vulnerability of the SGIUtility component in the HMI terminal configuration software for Schneider Electric EcoStruxure Operator Terminal Expert and the SCADA Pro-face BLUE software allows a malicious individual to execute arbitrary code.

The vulnerability of the SGIUtility component in Schneider Electric’s HMI terminal configuration software, as well as in the SCADA Pro-face BLUE software, is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to execute arbitrary...

The vulnerability of the EcoStruxure Power Monitoring Expert software lies in its incorrect session duration, which allows an intruder to gain unauthorized access to protected information.

The vulnerability of the EcoStruxure Power Monitoring Expert software is related to incorrect session duration settings. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2023-1876 · Schneider Electric · Ecostruxure Power Monitoring Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Power Monitoring Expert affected versions not specified Description: A CWE-613: Insufficient Session Expiration issue exists, allowing an attacker to maintain unauthorized access over a hijacked session after the legitimate user h...

The vulnerability of the Power Monitoring Expert software allows a intruder to view and modify the equipment settings.

The vulnerability of the Power Monitoring Exper software-related software is related to insufficient verification of input data. Exploiting this vulnerability allows a remote attacker to view and modify the settings of the equipment...

Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...