Schneider Electric Vulnerabilities and Affected Products
Vulnerabilities associated with Data Center Expert.
Products
Clear product- StruxureWare Data Center Expert15 vulnerabilities
- EcoStruxure Control Expert12 vulnerabilities
- Modicon M340 CPU (part numbers BMXP34*)12 vulnerabilities
- IGSS Data Server (IGSSdataServer.exe)10 vulnerabilities
- PowerChute™ Serial Shutdown10 vulnerabilities
- EcoStruxure Process Expert9 vulnerabilities
- IGSS Dashboard (DashBoard.exe)9 vulnerabilities
- Custom Reports (RMS16.dll)8 vulnerabilities
- IGSS Data Server(IGSSdataServer.exe)8 vulnerabilities
- EcoStruxure™ IT Data Center Expert7 vulnerabilities
- Modicon Controllers M241/M2517 vulnerabilities
- Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)7 vulnerabilities
- Modicon Momentum Unity M1E Processor (171CBU*)7 vulnerabilities
- OPC UA Modicon Communication Module7 vulnerabilities
- Pro-face BLUE7 vulnerabilities
- X80 advanced RTU Communication Module7 vulnerabilities
- Data Center Expert6 vulnerabilities
- EcoStruxure Operator Terminal Expert6 vulnerabilities
- EcoStruxure™ Power Monitoring Expert (PME)6 vulnerabilities
- EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module6 vulnerabilities
- Modicon M580 CPU (part numbers BMEP* and BMEH*)6 vulnerabilities
- Sage 14106 vulnerabilities
- Sage 14306 vulnerabilities
- Sage 14506 vulnerabilities
- Sage 24006 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-8530MEDIUM | CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS. CWE-306Oct 11, 2024 | CVSS5.9v3.1 | EPSS0.548% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-8531HIGH | CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is manipulated to include arbitrary bash scripts that are executed as root. CWE-347Oct 11, 2024 | CVSS7.2v3.1 | EPSS0.459% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-32519HIGH | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0) | CVSS8.0v3.1 | EPSS0.476% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-32518HIGH | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32520. Affected Products: Data Center Expert (Versions prior to V7.9.0) CWE-522Jan 30, 2023 | CVSS8.0v3.1 | EPSS0.537% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-32520HIGH | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert (Versions prior to V7.9.0) CWE-522Jan 30, 2023 | CVSS8.0v3.1 | EPSS0.537% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-32521HIGH | A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0) CWE-502Jan 30, 2023 | CVSS7.1v3.1 | EPSS0.541% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |