PT-2022-3521 · Schneider Electric · Ecostruxure Power Commission

Published 2022-06-14 · Updated 2023-02-07 · CVE-2022-22732

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EcoStruxure Power Commission versions prior to V2.22

Description A vulnerability exists that could cause all remote domains to access the resources supplied by the server when an attacker sends a fetch request from a third-party site or malicious site. This issue is related to the exposure of information in an erroneous data sphere, which may allow a remote attacker to disclose protected information using a specially crafted request.

Recommendations For versions prior to V2.22, update to version V2.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation. Avoid using the server to supply resources to remote domains until the issue is resolved.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2022-04302

CVE-2022-22732

Affected Products

Ecostruxure Power Commission

References · 7

• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22732 · Security Note
• https://bdu.fstec.ru/vul/2022-04302 · Security Note
• https://t.me/cvenotify/43162 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf · Note
• https://t.me/cibsecurity/57188 · Telegram Post