PT-2023-3272 · Schneider Electric · Struxureware Data Center Expert

Published 2023-02-14 · Updated 2023-04-27 · CVE-2023-25550

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StruxureWare Data Center Expert versions prior to 7.9.2

Description The issue is related to improper control of code generation, allowing remote code execution via the hostname parameter when maliciously crafted hostname syntax is entered. This can enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7.9.2, consider disabling the use of the hostname parameter until a patch is available to prevent remote code execution. Restrict access to the system to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-03395

CVE-2023-25550

Affected Products

Struxureware Data Center Expert

References · 7

• https://osv.dev/vulnerability/CVE-2023-25550 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03395 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25550 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Note
• https://t.me/cibsecurity/62400 · Telegram Post
• https://vuldb.com/?id.226774 · Note