PT-2024-2038 · Schneider Electric · Easergy T200

Published 2024-03-12 · Updated 2024-03-18 · CVE-2024-2050

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric Easergy T200 (affected versions not specified)

Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This occurs when an attacker injects and executes arbitrary malicious JavaScript code within the context of the product. The vulnerability can be exploited by a remote attacker to conduct a cross-site scripting attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-01916

CVE-2024-2050

Affected Products

Easergy T200

References · 7

• https://bdu.fstec.ru/vul/2024-01916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2050 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf · Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf · Note
• https://twitter.com/CVEnew/status/1769760609992888637 · Twitter Post
• https://t.me/cvenotify/74160 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1769795867098182064 · Twitter Post