Improper Buffer Restrictions in EcoStruxure Control Expert by Schneider Electric
CVE-2022-24322

5.3MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Ecostruxure Control Expert
Vendor
CVE Published:
9 March 2022

Summary

A vulnerability exists in EcoStruxure Control Expert that allows an attacker to disrupt the communication between a Modicon controller and the engineering software. By intercepting and altering specific Modbus response data, attackers can manipulate interactions, potentially leading to operational issues. This issue affects EcoStruxure Control Expert versions prior to V15.0 SP1, highlighting the importance of securing communications to protect against unauthorized data manipulation.

Affected Version(s)

EcoStruxure Control Expert V15.0 SP1 and prior

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.