PT-2023-3273 · Schneider Electric · Struxureware Data Center Expert

Published 2023-02-14 · Updated 2023-04-27 · CVE-2023-25549

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StruxureWare Data Center Expert versions prior to 7.9.2

Description A code injection issue exists, allowing for remote code execution when using a parameter of the DCE network settings endpoint. This could enable a remote attacker to execute arbitrary code.

Recommendations For versions prior to 7.9.2, update to a version newer than 7.9.2 to resolve the issue. As a temporary workaround, consider restricting access to the DCE network settings endpoint to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected endpoint until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-03396

CVE-2023-25549

Affected Products

Struxureware Data Center Expert

References · 6

• https://osv.dev/vulnerability/CVE-2023-25549 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25549 · Security Note
• https://bdu.fstec.ru/vul/2023-03396 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf · Note
• https://vuldb.com/pl/?id.226793 · Note