CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services of which one managing audit trail data and the other acting as server managing client request that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standa...

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services of which one managing audit trail data and the other acting as server managing client request that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standa...

CVE-2025-0327

CVE-2025-0327 corresponds to an improper privilege management vulnerability in Schneider Electric EcoStruxure Process Expert (and EcoStruxure Process Expert for AVEVA System Platform) with two Windows services (one for audit trail data, one server for client requests). The root cause is modificat...

CVE-2025-1060

CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker...

CVE-2025-1059

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device...

CVE-2024-10083

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked locally by an authenticated user with crafted input...

CVE-2025-1070

CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded...

CVE-2025-1070

CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded...

CVE-2025-1070

Schneider Electric ASCO 5310 and ASCO 5350 Remote Annunciators are affected by CVE-2025-1070 (CWE-434): Unrestricted Upload of File with Dangerous Type, which could render the device inoperable when a malicious file is downloaded. The issue is described across multiple sources (Red Hat, NVD, CNNV...

CVE-2025-1060

CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker...

CVE-2025-1060

CVE-2025-1060 concerns Schneider Electric ASCO 5310/5350 Remote Annunciator. The vulnerability is CWE-319: Cleartext Transmission of Sensitive Information, potentially exposing data if network traffic is sniffed. Affected product family: Schneider Electric ASCO 5310/5350 Remote Annunciators (stan...

CVE-2025-1059

CVE-2025-1059 is associated with Schneider Electric ASCO 5310/5350 Remote Annunciator products. The connected sources describe an Allocation of Resources Without Limits or Throttling vulnerability that could cause communications to stop on the device webserver when malicious packets are received ...

CVE-2025-1059

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device...

CVE-2025-1059

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device...

CVE-2025-1058

CVE-2025-1058 affects Schneider Electric ASCO 5310 and ASCO 5350 Remote Annunciator products. The issue is CWE-494: downloading code without integrity checks, which could render the device inoperable if malicious firmware is downloaded. Additional disclosures (CWE-770, CWE-319, CWE-434) appear in...

CVE-2025-1058

CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded...

CVE-2024-10083

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked locally by an authenticated user with crafted input...

CVE-2024-10083

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked locally by an authenticated user with crafted input...

CVE-2024-10083

CVE-2024-10083 describes an improper input validation (CWE-20) in Schneider Electric Uni-Telway driver integrated with EcoStruxure Control Expert, EcoStruxure Process Expert, and OPC Factory Server. The vulnerability can allow a locally authenticated user to cause denial of service on an engineer...

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua users endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to enumerate users via crafted HTTP requests...