cnvd - cnvd-2023-37592

cnvd-2023-37592

Vulnerability from cnvd

Title: Schneider Electric StruxureWare Data Center Expert访问控制错误漏洞

Description:

Schneider Electric StruxureWare Data Center Expert是法国施耐德电气（Schneider Electric）公司的一种监控软件。适用于各种组织监控其全公司范围内的电力、制冷、安全、环境。

Schneider Electric StruxureWare Data Center Expert 7.9.2及之前版本存在访问控制错误漏洞，攻击者可利用该漏洞在篡改DCE端点上的设备文件传输设置时查看未经授权的内容、更改或删除内容或执行未经授权的功能。

Severity: 高

Patch Name: Schneider Electric StruxureWare Data Center Expert访问控制错误漏洞的补丁

Patch Description:

Schneider Electric StruxureWare Data Center Expert 7.9.2及之前版本存在访问控制错误漏洞，攻击者可利用该漏洞在篡改DCE端点上的设备文件传输设置时查看未经授权的内容、更改或删除内容或执行未经授权的功能。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf

Reference: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf

Impacted products

Name
Schneider Electric StruxureWare Data Center Expert <=7.9.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-25552",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-25552"
    }
  },
  "description": "Schneider Electric StruxureWare Data Center Expert\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u79cd\u76d1\u63a7\u8f6f\u4ef6\u3002\u9002\u7528\u4e8e\u5404\u79cd\u7ec4\u7ec7\u76d1\u63a7\u5176\u5168\u516c\u53f8\u8303\u56f4\u5185\u7684\u7535\u529b\u3001\u5236\u51b7\u3001\u5b89\u5168\u3001\u73af\u5883\u3002\n\nSchneider Electric StruxureWare Data Center Expert 7.9.2\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7be1\u6539DCE\u7aef\u70b9\u4e0a\u7684\u8bbe\u5907\u6587\u4ef6\u4f20\u8f93\u8bbe\u7f6e\u65f6\u67e5\u770b\u672a\u7ecf\u6388\u6743\u7684\u5185\u5bb9\u3001\u66f4\u6539\u6216\u5220\u9664\u5185\u5bb9\u6216\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u529f\u80fd\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-02.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-37592",
  "openTime": "2023-05-16",
  "patchDescription": "Schneider Electric StruxureWare Data Center Expert\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u79cd\u76d1\u63a7\u8f6f\u4ef6\u3002\u9002\u7528\u4e8e\u5404\u79cd\u7ec4\u7ec7\u76d1\u63a7\u5176\u5168\u516c\u53f8\u8303\u56f4\u5185\u7684\u7535\u529b\u3001\u5236\u51b7\u3001\u5b89\u5168\u3001\u73af\u5883\u3002\r\n\r\nSchneider Electric StruxureWare Data Center Expert 7.9.2\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7be1\u6539DCE\u7aef\u70b9\u4e0a\u7684\u8bbe\u5907\u6587\u4ef6\u4f20\u8f93\u8bbe\u7f6e\u65f6\u67e5\u770b\u672a\u7ecf\u6388\u6743\u7684\u5185\u5bb9\u3001\u66f4\u6539\u6216\u5220\u9664\u5185\u5bb9\u6216\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u529f\u80fd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric StruxureWare Data Center Expert\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Schneider Electric StruxureWare Data Center Expert \u003c=7.9.2"
  },
  "referenceLink": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-02.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2023-04-21",
  "title": "Schneider Electric StruxureWare Data Center Expert\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2023-25552 (GCVE-0-2023-25552)

Vulnerability from cvelistv5

Published

2023-04-18 20:33

Modified

2025-03-03 19:16

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-862 - Missing Authorization

Summary

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)

References

▼	URL	Tags
	https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf

Impacted products

	Vendor	Product	Version
	Schneider Electric	StruxureWare Data Center Expert	Version: All <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:25:19.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-02.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-25552",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-03T17:37:15.543688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-03T19:16:53.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StruxureWare Data Center Expert",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "lessThanOrEqual": "V7.9.2",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-02-14T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\n\n\nA CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized\ncontent, changes or deleting of content, or performing unauthorized functions when tampering\nthe Device File Transfer settings on DCE endpoints. \n\n \n\n Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)\u003c/p\u003e"
            }
          ],
          "value": "\n\n\nA CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized\ncontent, changes or deleting of content, or performing unauthorized functions when tampering\nthe Device File Transfer settings on DCE endpoints. \n\n \n\n Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-18T20:33:50.548Z",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-02.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2023-25552",
    "datePublished": "2023-04-18T20:33:50.548Z",
    "dateReserved": "2023-02-07T17:00:03.778Z",
    "dateUpdated": "2025-03-03T19:16:53.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted