PT-2024-7777 · Schneider Electric · Ecostruxure Data Center Expert

Published 2024-07-16 · Updated 2024-10-18 · CVE-2024-8530

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Data Center Expert (affected versions not specified)

Description A missing authentication for critical function issue exists, which could cause exposure of private data when an already generated "logcaptures" archive is accessed directly by HTTPS. This flaw can lead to unauthorized access to sensitive data. The vulnerability is related to the absence of authentication for a critical function, allowing a remote attacker to obtain access to confidential information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-09270

CVE-2024-8530

ZDI-24-1416

Affected Products

Ecostruxure Data Center Expert

References · 10

• https://zerodayinitiative.com/advisories/ZDI-24-1416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8530 · Security Note
• https://bdu.fstec.ru/vul/2024-09270 · Security Note
• https://t.me/cvedetector/7680 · Telegram Post
• https://download.schneider-electric.com/doc/SEVD-2024-282-01/SEVD-2024-282-01.pdf · Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-289-02 · Note
• https://feedly.com/cve/CVE-2024-8530 · Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-01.pdf · Note
• https://t.me/cvenotify/97876 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847120932508237889 · Twitter Post