PT-2023-1607 · Schneider Electric · Struxureware Data Center Expert
CVE-2023-25548
·
Publicado
2023-02-14
·
Atualizado
2023-04-27
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
StruxureWare Data Center Expert versions prior to 7.9.2
Description
The issue is related to insufficient authorization procedures in the system, allowing a remote attacker to potentially execute arbitrary code. Specifically, it involves a CWE-863: Incorrect Authorization vulnerability that could allow access to device credentials on specific endpoints not being properly secured when a low-privileged user is used.
Recommendations
For versions prior to 7.9.2, update to a version that includes the necessary security patches to address the authorization vulnerability. As a temporary workaround, consider restricting access to specific DCE endpoints to minimize the risk of exploitation.
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Struxureware Data Center Expert