PT-2024-2809 · Schneider Electric · Ecostruxure Control Expert+1

Published 2024-02-13 · Updated 2024-12-11 · CVE-2023-27975

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert (affected versions not specified) EcoStruxure Process Expert (affected versions not specified)

Description A vulnerability exists that could cause unauthorized access to the project file when a local user tampers with the memory of the engineering workstation. This issue is related to insufficiently protected credentials.

Recommendations For EcoStruxure Control Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For EcoStruxure Process Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2024-02950

CVE-2023-27975

Affected Products

Ecostruxure Control Expert

Ecostruxure Process Expert

References · 9

• https://osv.dev/vulnerability/CVE-2023-27975 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02950 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27975 · Security Note
• https://twitter.com/CVEnew/status/1757815451508486543 · Twitter Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf · Note
• https://twitter.com/cracbot/status/1758008300325744803 · Twitter Post
• https://t.me/cvenotify/103906 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757921683825131713 · Twitter Post