PT-2023-2948 · Schneider Electric · Ecostruxure Control Expert

Published

2023-04-11

·

Updated

2023-05-12

·

CVE-2023-1548

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert versions 15.1 and above
Description The issue is related to improper privilege management, which could allow a local user to perform a denial of service through the console server service. This is due to insufficient access controls within the system.
Recommendations For EcoStruxure Control Expert versions 15.1 and above, consider restricting access to the console server service as a temporary workaround until a patch is available. Additionally, review and implement proper privilege management practices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-02957
CVE-2023-1548

Affected Products

Ecostruxure Control Expert