PT-2022-3587 · Schneider Electric · Ecostruxure Control Expert+2

Published 2022-04-14 · Updated 2024-08-03 · CVE-2022-26507

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert (affected versions not specified) EcoStruxure Process Expert (affected versions not specified) SCADAPack RemoteConnect (affected versions not specified)

Description The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For EcoStruxure Control Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For EcoStruxure Process Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SCADAPack RemoteConnect, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-04371

CVE-2022-26507

Affected Products

Ecostruxure Control Expert

Ecostruxure Process Expert

Scadapack Remoteconnect

References · 8

• https://bdu.fstec.ru/vul/2022-04371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-26507 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26507 · Vendor Advisory
• https://t.me/cvenotify/28899 · Telegram Post
• https://claroty.com · Note
• https://t.me/cvenotify/88695 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-02 · Note
• https://t.me/cibsecurity/40759 · Telegram Post