CVE-2023-37197

HIGH

StruxureWare Data Center Expert < 7.9.3 - Authenticated SQL Injection via Mass Configuration Settings

Title source: llm

Description

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.

References (1)

Core 1

Core References

Vendor Advisory

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf

Scores

CVSS v3 8.8

EPSS 0.0042

EPSS Percentile 61.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

schneider-electric/struxureware_data_center_expert < 7.9.3

Published Jul 12, 2023

Tracked Since Feb 18, 2026