Improper Input Neutralization in Schneider Electric's Web System
CVE-2023-5985

4.8MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Ion8650
Ion8800
Vendor
CVE Published:
15 November 2023

What is CVE-2023-5985?

A vulnerability categorized as CWE-79 arises from improper neutralization of user input during the generation of web pages in Schneider Electric's products. This flaw can be exploited by an attacker who holds admin privileges, leading to potential browser compromise for users due to the manipulation of system values. This situation emphasizes the importance of proper input handling and validation mechanisms in web applications to safeguard user sessions and data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ION8650 All versions

ION8800 All versions

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.