Improper Condition Checks in EcoStruxure Controllers by Schneider Electric
CVE-2022-24323

5.3MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure Process Expert
Ecostruxure Control Expert
Vendor
CVE Published:
9 March 2022

What is CVE-2022-24323?

A vulnerability exists in the communication between EcoStruxure controllers and their engineering software, where improper checks during certain conditions may allow attackers to intercept and manipulate Modbus response data. This could lead to potential disruptions, making devices vulnerable to unauthorized control and exposing critical system operations to risks.

Affected Version(s)

EcoStruxure Control Expert V15.0 SP1 and prior

EcoStruxure Process Expert V2021 and prior

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.