PT-2023-1876 · Schneider Electric · Ecostruxure Power Monitoring Expert

Published 2023-03-14 · Updated 2023-05-01 · CVE-2023-28003

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EcoStruxure Power Monitoring Expert (affected versions not specified)

Description A CWE-613: Insufficient Session Expiration issue exists, allowing an attacker to maintain unauthorized access over a hijacked session after the legitimate user has signed out of their account. This could enable an attacker to access protected information without permission.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2023-01477

CVE-2023-28003

Affected Products

Ecostruxure Power Monitoring Expert

References · 8

• https://bdu.fstec.ru/vul/2023-01477 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28003 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28003 · Vendor Advisory
• https://t.me/cibsecurity/62403 · Telegram Post
• https://t.me/cvenotify/49488 · Telegram Post
• https://t.me/cvenotify/48530 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-01.pdf · Note