Hard-coded Credentials Vulnerability Could Lead to Local Privilege Escalation
CVE-2024-0865

7.8HIGH

Key Information:

Vendor

Unknown

Status
Ecostruxure It Gateway
Vendor
CVE Published:
12 June 2024

What is CVE-2024-0865?

A vulnerability exists in Schneider Electric Automation products due to the usage of hard-coded credentials. This flaw enables a local user who is logged in as a non-administrative user to escalate their privileges, potentially compromising the security of the entire system. This underscores the importance of regular security assessments and the need for secure credential management practices.

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.