PT-2023-3273 · Schneider Electric · Struxureware Data Center Expert

CVE-2023-25549 · Publicado 2023-02-14 · Atualizado 2023-04-27

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StruxureWare Data Center Expert versions prior to 7.9.2

Description A code injection issue exists, allowing for remote code execution when using a parameter of the DCE network settings endpoint. This could enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7.9.2, update to a version newer than 7.9.2 to resolve the issue. As a temporary workaround, consider restricting access to the DCE network settings endpoint to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected endpoint until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-03396

CVE-2023-25549

Produtos afetados

Struxureware Data Center Expert

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-25549 · Aviso do Fabricante
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Nota
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25549 · Nota de Segurança
• https://vuldb.com/pl/?id.226793 · Nota
• https://bdu.fstec.ru/vul/2023-03396 · Nota de Segurança