Path Traversal Vulnerability in EcoStruxure Power Commission by Schneider Electric
CVE-2022-0223

6.5MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Ecostruxure Power Commission
Vendor
CVE Published:
30 January 2023

Summary

A vulnerability exists in the EcoStruxure Power Commission software due to improper limitations of pathname, allowing attackers to exploit this weakness. This may enable unauthorized users to create or overwrite essential files, leading to potential unauthenticated code execution. It is crucial for users of affected versions to update their software to mitigate the risk of exploitation.

Affected Version(s)

EcoStruxure Power Commission All

References

https://download.schneider-electric.com/files?p_enDocType...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.