PT-2023-1019 · Schneider Electric · Ecostruxure Geo Scada Expert+1

Published 2023-01-10 · Updated 2023-06-14 · CVE-2023-22610

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions EcoStruxure Geo SCADA Expert versions 2019 through 2021 prior to October 2022 ClearSCADA versions prior to the fixed version

Description A vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port. This issue is related to incorrect authorization.

Recommendations For EcoStruxure Geo SCADA Expert versions 2019 through 2021 prior to October 2022, update to a version released after October 2022 to resolve the issue. For ClearSCADA, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

BDU:2023-00072

CVE-2023-22610

Affected Products

Clearscada

Ecostruxure Geo Scada Expert

References · 9

• https://osv.dev/vulnerability/CVE-2023-22610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00072 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22610 · Security Note
• https://t.me/cibsecurity/57230 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Note
• https://t.me/cvenotify/52283 · Telegram Post
• https://t.me/cvenotify/43808 · Telegram Post
• https://t.me/cvenotify/43215 · Telegram Post