Improper Certificate Validation Vulnerability in ClearSCADA and EcoStruxure Geo SCADA Expert
CVE-2022-24320

5.9MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Clearscada (all Versions), Ecostruxure Geo Scada Expert 2019 (all Versions), Ecostruxure Geo Scada Expert 2020 (all Versions)
Vendor
CVE Published:
9 February 2022

What is CVE-2022-24320?

An improper certificate validation vulnerability exists in ClearSCADA and EcoStruxure Geo SCADA Expert, which could potentially allow attackers to execute Man-in-the-Middle attacks. This vulnerability arises when the communication between the client and the Geo SCADA database server is intercepted, enabling unauthorized access and data manipulation. It is crucial for users of these systems to implement necessary mitigations to secure their environments against potential exploits.

Affected Version(s)

ClearSCADA (All ), EcoStruxure Geo SCADA Expert 2019 (All ), EcoStruxure Geo SCADA Expert 2020 (All ) ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...
x_refsource_MISC
https://github.com/mandiant/Vulnerability-Disclosures/blo...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.