PT-2023-2553 · Schneider Electric · Ecostruxure Control Expert
CVE-2023-27976
·
Publicado
2023-04-11
·
Atualizado
2023-05-12
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
EcoStruxure Control Expert versions 15.1 and above
Description
A vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. This issue is related to insufficient boundaries within the controlled sphere of the system, which could allow a remote attacker to execute arbitrary code.
Recommendations
For EcoStruxure Control Expert versions 15.1 and above, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exposure of Resource to Wrong Sphere
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ecostruxure Control Expert