Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Cybersecurity Admin Expert product.
The EcoStruxure™ Cybersecurity Admin Expert product (CAE) is a solution for managing cybersecurity in an electrical network’s operational technology (OT).
Failure to apply the remediation provided below may risk man-in-the-middle and/or device spoofing attacks, which could result in the total compromise of devices configured by the CAE.
Vulnerabilities 2
-
High 8.0
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of…
-
High 7.9
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to…
Revision history
-
#1
Original Release
References
-
EcoStruxure™ Cybersecurity Admin Expert - SEVD-2022-165-08 PDF Version
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/