Medium SEVD-2022-039-05 4 CVEs

EcoStruxure Geo SCADA Expert

Published Feb 8, 2022 · Updated Feb 8, 2022

Vendor: Schneider Electric Product: ClearSCADA Product: EcoStruxure Geo SCADA Expert 2019 Product: EcoStruxure Geo SCADA Expert 2020

Summary

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Geo SCADA Expert product (formerly known as ClearSCADA).
EcoStruxure Geo SCADA Expert software is an open, flexible, and scalable software system for telemetry and remote SCADA solutions.
Failure to apply the remediations provided below may risk the impersonation of client activity or the revealing of account credentials, which could result in unauthorized system access.

Vulnerabilities 4

Unscored —

CVE-2022-24318

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the se…

Feb 9, 2022
Unscored —

CVE-2022-24319

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…

Feb 9, 2022
Unscored —

CVE-2022-24320

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…

Feb 9, 2022
Unscored —

CVE-2022-24321

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service…

Feb 9, 2022

Revision history

2022-02-08 #1
Original release

References

EcoStruxure Geo SCADA Expert - SEVD-2022-039-05 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/