All the vulnerabilites related to Schneider Electric - EcoStruxure IT Gateway
var-202005-0051
Vulnerability from variot
In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code. Fazecast Provides jSerialComm To DLL There is a read vulnerability. jSerialComm Is Fazecast Provides platform-independent serial communication provided by Java The library. This vulnerability allows local attackers to escalate privileges on affected installations of Schneider Electric EcoStruxure IT Gateway. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of files within the Temp directory. The issue results from an incorrect assignment of privilege to a critical resource. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Schneider Electric EcoStruxure IT Gateway is a set of cloud-based data center management as a service (DMaaS) products of French Schneider Electric company. A code issue vulnerability exists in Fazecast jSerialComm 2.2.2 and earlier versions
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.7.0.64"
},
{
"_id": null,
"model": "jserialcomm",
"scope": "lte",
"trust": 1.0,
"vendor": "fazecast",
"version": "2.2.2"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.5.2.28"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.5.0.66"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.6.2.14"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "gte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.6.0.39"
},
{
"_id": null,
"model": "jserialcomm",
"scope": "eq",
"trust": 0.9,
"vendor": "fazecast",
"version": "2.2.2"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "schneider electric",
"version": "1.5.x \u7cfb"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "schneider electric",
"version": "1.6.x \u7cfb"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "schneider electric",
"version": "1.7.x \u7cfb"
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": null,
"trust": 0.7,
"vendor": "schneider electric",
"version": null
},
{
"_id": null,
"model": "ecostruxure it gateway",
"scope": "eq",
"trust": 0.1,
"vendor": "se",
"version": "1.7.0.64"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "VULMON",
"id": "CVE-2020-10626"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "NVD",
"id": "CVE-2020-10626"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:misc:fazecast_jserialcomm",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:schneider_electric:ecostruxure_it_gateway",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
}
]
},
"credits": {
"_id": null,
"data": "Ryan Wincey (@rwincey) of Securifera",
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
}
],
"trust": 0.7
},
"cve": "CVE-2020-10626",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.4,
"id": "CVE-2020-10626",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.4,
"id": "VHN-163123",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2020-10626",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "JPCERT/CC score",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-004145",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2020-10626",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-10626",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "JPCERT/CC",
"id": "JVNDB-2020-004145",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2020-10626",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202005-154",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-163123",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-10626",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "VULHUB",
"id": "VHN-163123"
},
{
"db": "VULMON",
"id": "CVE-2020-10626"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
},
{
"db": "NVD",
"id": "CVE-2020-10626"
}
]
},
"description": {
"_id": null,
"data": "In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code. Fazecast Provides jSerialComm To DLL There is a read vulnerability. jSerialComm Is Fazecast Provides platform-independent serial communication provided by Java The library. This vulnerability allows local attackers to escalate privileges on affected installations of Schneider Electric EcoStruxure IT Gateway. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of files within the Temp directory. The issue results from an incorrect assignment of privilege to a critical resource. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Schneider Electric EcoStruxure IT Gateway is a set of cloud-based data center management as a service (DMaaS) products of French Schneider Electric company. A code issue vulnerability exists in Fazecast jSerialComm 2.2.2 and earlier versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10626"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "VULHUB",
"id": "VHN-163123"
},
{
"db": "VULMON",
"id": "CVE-2020-10626"
}
],
"trust": 2.43
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2020-10626",
"trust": 3.3
},
{
"db": "ZDI",
"id": "ZDI-20-588",
"trust": 1.3
},
{
"db": "JVN",
"id": "JVNVU98082388",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-10377",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "48504",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1621",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-163123",
"trust": 0.1
},
{
"db": "PULSESECURE",
"id": "SA201260",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-10626",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "VULHUB",
"id": "VHN-163123"
},
{
"db": "VULMON",
"id": "CVE-2020-10626"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
},
{
"db": "NVD",
"id": "CVE-2020-10626"
}
]
},
"id": "VAR-202005-0051",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-163123"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:51:29.708000Z",
"patch": {
"_id": null,
"data": [
{
"title": "jSerialComm",
"trust": 1.6,
"url": "https://github.com/Fazecast/jSerialComm/releases"
},
{
"title": "Schneider Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://www.us-cert.gov/ics/advisories/ICSA2012601"
},
{
"title": "Fazecast jSerialComm Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122410"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-427",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-163123"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "NVD",
"id": "CVE-2020-10626"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.3,
"url": "https://www.us-cert.gov/ics/advisories/icsa2012601"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10626"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu98082388"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/48504"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10626"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-20-588/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1621/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/427.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181436"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-588"
},
{
"db": "VULHUB",
"id": "VHN-163123"
},
{
"db": "VULMON",
"id": "CVE-2020-10626"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
},
{
"db": "NVD",
"id": "CVE-2020-10626"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-20-588",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-163123",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2020-10626",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004145",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202005-154",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2020-10626",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2020-05-06T00:00:00",
"db": "ZDI",
"id": "ZDI-20-588",
"ident": null
},
{
"date": "2020-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-163123",
"ident": null
},
{
"date": "2020-05-14T00:00:00",
"db": "VULMON",
"id": "CVE-2020-10626",
"ident": null
},
{
"date": "2020-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004145",
"ident": null
},
{
"date": "2020-05-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202005-154",
"ident": null
},
{
"date": "2020-05-14T16:15:12.530000",
"db": "NVD",
"id": "CVE-2020-10626",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2020-05-06T00:00:00",
"db": "ZDI",
"id": "ZDI-20-588",
"ident": null
},
{
"date": "2022-01-31T00:00:00",
"db": "VULHUB",
"id": "VHN-163123",
"ident": null
},
{
"date": "2020-05-19T00:00:00",
"db": "VULMON",
"id": "CVE-2020-10626",
"ident": null
},
{
"date": "2020-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004145",
"ident": null
},
{
"date": "2022-03-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202005-154",
"ident": null
},
{
"date": "2024-11-21T04:55:43.520000",
"db": "NVD",
"id": "CVE-2020-10626",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Fazecast Made jSerialComm To DLL Read vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004145"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202005-154"
}
],
"trust": 0.6
}
}
cve-2024-10575
Vulnerability from cvelistv5
Published
2024-11-13 04:35
Modified
2024-11-13 15:14
Severity ?
10.0 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS score ?
Summary
CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on
the network and potentially impacting connected devices.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Schneider Electric | EcoStruxure IT Gateway |
Version: Version 1.21.0.6 Version: Version 1.22.0.3 Version: Version 1.22.1.5 Version: Version 1.23.0.4 |
|
|
|||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:schneider-electric:ecostruxure_it_gateway:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ecostruxure_it_gateway",
"vendor": "schneider-electric",
"versions": [
{
"status": "affected",
"version": "1.21.0.6"
},
{
"status": "affected",
"version": "1.22.0.3"
},
{
"status": "affected",
"version": "1.22.1.5"
},
{
"status": "affected",
"version": "1.23.0.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10575",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T15:14:10.869591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:14:17.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EcoStruxure IT Gateway",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 1.21.0.6"
},
{
"status": "affected",
"version": "Version 1.22.0.3"
},
{
"status": "affected",
"version": "Version 1.22.1.5"
},
{
"status": "affected",
"version": "Version 1.23.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on\nthe network and potentially impacting connected devices."
}
],
"value": "CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on\nthe network and potentially impacting connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T04:35:44.556Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/doc/SEVD-2024-317-04/SEVD-2024-317-04.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-10575",
"datePublished": "2024-11-13T04:35:44.556Z",
"dateReserved": "2024-10-31T08:33:14.823Z",
"dateUpdated": "2024-11-13T15:14:17.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-0865
Vulnerability from cvelistv5
Published
2024-06-12 17:23
Modified
2024-08-01 18:18
Severity ?
EPSS score ?
Summary
CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege
escalation when logged in as a non-administrative user.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Schneider Electric | EcoStruxure IT Gateway |
Version: 1.20.x and prior |
|
|
|||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:schneider-electric:ecostruxure_it_gateway:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ecostruxure_it_gateway",
"vendor": "schneider-electric",
"versions": [
{
"lessThan": "1.20.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T19:59:08.710375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T20:04:39.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:18:18.824Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-03.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EcoStruxure IT Gateway",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "1.20.x and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege\nescalation when logged in as a non-administrative user."
}
],
"value": "CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege\nescalation when logged in as a non-administrative user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T17:23:00.908Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-03.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-0865",
"datePublished": "2024-06-12T17:23:00.908Z",
"dateReserved": "2024-01-24T17:18:07.117Z",
"dateUpdated": "2024-08-01T18:18:18.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}