Command injection

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...

CVE-2023-25555

CVE-2023-25555 affects Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior). The vulnerability is OS command injection (CWE-78) that could allow an attacker with valid credentials to execute unprivileged shell commands on the appliance via SSH. Affected versions are 7.9.2 and ear...

CVE-2023-25555

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: StruxureWare Data Center Expert V7.9.2 an...

CVE-2023-25555

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: StruxureWare Data Center Expert V7.9.2 an...

CVE-2023-25553

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists on a DCE endpoint through the logging capabilities of the webserver. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25553

CVE-2023-25553 affects Schneider Electric StruxureWare Data Center Expert

CVE-2023-25551

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25551

Summary of CVE-2023-25551 (CWE-79, XSS) : A cross-site scripting vulnerability exists in Schneider Electric StruxureWare Data Center Expert (DCE) file upload endpoint, exploitable by tampering with HTTP parameters. Affected products: StruxureWare Data Center Expert (versions prior to 7.9.2). Root...

CVE-2023-25550

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25550

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25550

The CVE-2023-25550 entry concerns Schneider Electric StruxureWare Data Center Expert (v7.9.2 and prior) with a CWE-94 code injection vulnerability that enables remote code execution via the hostname parameter when crafted hostname syntax is entered. The vulnerability arises from improper control ...

CVE-2023-25549

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25549

Schneider Electric StruxureWare Data Center Expert (versions prior to 7.9.2) contains a CWE-94 code-injection flaw that allows remote code execution via a parameter of the DCE network settings endpoint. Exploitation details are not elaborated in the provided documents, but the issue is described ...

CVE-2023-25549

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...

CVE-2023-25554

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...

CVE-2023-25554

CVE-2023-25554 affects Schneider Electric StruxureWare Data Center Expert (versions 7.9.2 and prior). The issue is a CWE-78 OS Command Injection that enables local privilege escalation on the appliance when a malicious OS command is entered. Affected products and impact are documented across mult...

CVE-2023-25552

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert V7.9.2...

CVE-2023-25552

CVE-2023-25552 is a missing-authorization vulnerability in Schneider Electric StruxureWare Data Center Expert prior to version 7.9.2. The issue allows an attacker to view unauthorized content, and to change, delete content, or perform unauthorized functions by tampering with the Device File Trans...

CVE-2023-25552

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert V7.9.2...

CVE-2023-25548

A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured when a hacker is using a low privileged user. Affected products: StruxureWare Data Center Expert V7.9.2 and prior...