PT-2023-1390 · Schneider Electric · Struxureware Data Center Expert

Published

2023-02-14

·

Updated

2023-04-27

·

CVE-2023-25554

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions StruxureWare Data Center Expert versions 7.9.2 and prior
Description A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists, allowing a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. This issue can be exploited by an attacker to elevate their privileges.
Recommendations For StruxureWare Data Center Expert versions 7.9.2 and prior, as a temporary workaround, consider restricting the ability to enter Operating System commands on the device until a patch is available. Additionally, limit access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00759
CVE-2023-25554

Affected Products

Struxureware Data Center Expert