Information disclosure

Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2017-8371

Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2017-8371

CVE-2017-8371 affects Schneider Electric StruxureWare Data Center Expert prior to 7.4.0. The root cause is cleartext RAM storage of passwords, enabling potential remote disclosure of credentials via unspecified vectors. Public reports in multiple sources corroborate information disclosure in Stru...

Schneider Electric StruxureWare Data Center Expert Product Password Disclosure Vulnerability

StruxureWare Data Center Expert is a DCIM Data Center Infrastructure Management solution designed to monitor and control infrastructure, including security, power and environment. A password disclosure vulnerability exists in the Schneider Electric StruxureWare Data Center Expert product. The...

Schneider Electric Building Operation Automation Server Vulnerability

OVERVIEW Independent researcher Karn Ganeshen has identified a vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software. Schneider Electric has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely...

PT-2016-39: Information Disclosure in StruxureWare Data Center Expert

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in StruxureWare Data Center Expert. Vulnerability in StruxureWare Data Center Expert allows attackers to obtain product passwords in cleartext by reading random access memory RAM. How to fix Upda...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric Building Operation Application Server Operating System Command Injection Vulnerability

Schneider Electric StruxureWare Building Operation Application Server is a set of automation systems for small and medium-sized buildings from the French company Schneider Electric Schneider Electric. An operating system command injection vulnerability exists in Schneider Electric StruxureWare...

CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

Input validation

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

CVE-2016-2278

Affected product: Schneider Electric StruxureWare Building Operation Automation Server (AS 1.7 and earlier; AS-P 1.7 and earlier). Root cause: improper bypass of the msh minimal-shell protection allows remote authenticated administrators to execute arbitrary OS commands. Impact: remote command ex...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before version 2.15 is affected by a cleartext transmission vulnerability (CWE-319) where the client–server data stream is not encrypted, enabling remote attackers to discover user credentials by sniffing traffic. The issue affects StruxureWare ...

Schneider Electric StruxureWare Building Expert Plain Text Credentials Vulnerability

StruxureWare Building Expert is the building automation system. A plain text transmission vulnerability exists in Schneider Electric StruxureWare Building Expert products prior to version 2.15, which can be exploited by an attacker to obtain user login credentials...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...