PT-2023-1235 · Schneider Electric · Ecostruxure Geo Scada Expert+1

Published 2023-01-10 · Updated 2023-02-07 · CVE-2023-22611

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EcoStruxure Geo SCADA Expert versions 2019 through 2021 ClearSCADA (all versions)

Description A vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. This issue is related to the lack of protection for service data, which could allow a remote attacker to disclose protected information.

Recommendations For EcoStruxure Geo SCADA Expert versions 2019 through 2021, update to a version released after October 2022. For ClearSCADA, since all versions are affected and no specific fix is mentioned, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-00465

CVE-2023-22611

Affected Products

Clearscada

Ecostruxure Geo Scada Expert

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-22611 · Security Note
• https://bdu.fstec.ru/vul/2023-00465 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22611 · Vendor Advisory
• https://download.schneider-electric.com/files?p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf · Note
• https://t.me/cvenotify/43812 · Telegram Post
• https://t.me/cibsecurity/57227 · Telegram Post