PT-2023-1235 · Schneider Electric · Ecostruxure Geo Scada Expert+1

Publicado 2023-01-10 · Atualizado 2023-02-07 · CVE-2023-22611

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EcoStruxure Geo SCADA Expert versions 2019 through 2021 ClearSCADA (all versions)

Description A vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. This issue is related to the lack of protection for service data, which could allow a remote attacker to disclose protected information.

Recommendations For EcoStruxure Geo SCADA Expert versions 2019 through 2021, update to a version released after October 2022. For ClearSCADA, since all versions are affected and no specific fix is mentioned, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-00465

CVE-2023-22611

Produtos afetados

Clearscada

Ecostruxure Geo Scada Expert

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-22611 · Nota de Segurança
• https://download.schneider-electric.com/files?p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Nota
• https://bdu.fstec.ru/vul/2023-00465 · Nota de Segurança
• https://t.me/cvenotify/43812 · Publicação no Telegram
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Aviso do Fabricante
• https://t.me/cibsecurity/57227 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22611 · Aviso do Fabricante