PT-2023-1789 · Schneider Electric · Struxureware Data Center Expert

Published 2023-02-14 · Updated 2023-04-27 · CVE-2023-25552

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions StruxureWare Data Center Expert versions prior to 7.9.2

Description The issue is related to insufficient authorization procedures in the system, allowing a remote attacker to perform unauthorized functions, modify, or delete arbitrary content. This can be achieved by tampering with the Device File Transfer settings on DCE endpoints, potentially leading to viewing unauthorized content, changes, or deletion of content.

Recommendations For versions prior to 7.9.2, update to a version that includes the necessary authorization fixes to prevent unauthorized access and modifications. As a temporary workaround, consider restricting access to the Device File Transfer settings on DCE endpoints to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-01385

CVE-2023-25552

Affected Products

Struxureware Data Center Expert

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-25552 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01385 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25552 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Note
• https://t.me/cvenotify/48541 · Telegram Post
• https://t.me/cvenotify/48540 · Telegram Post