High SEVD-2022-312-01 3 CVEs

NetBotz 4 - 355/450/455/550/570

Published Nov 8, 2022 · Updated Feb 14, 2023 · Revision 2

Vendor: Schneider Electric Product: NetBotz 4 - 355 Product: NetBotz 4 - 450 Product: NetBotz 4 - 455 Product: NetBotz 4 - 550 Product: NetBotz 4 - 570

Summary

Schneider Electric is aware of multiple vulnerabilities in its NetBotz 4 - 355/450/455/550/570 products.
The NetBotz 4 - 355/450/455/550/570 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities.
Failure to apply the remediation provided below may risk device attacks which could result in device manipulation and unauthorized device access.
February 2023 Update: The CVSS scores were updated.

Vulnerabilities 3

High 7.6

CVE-2022-43376

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

Schneider Electric NetBotz 4 - 355/450/455/550/570 ICS / OT

Apr 18, 2023
High 7.5

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account take…

Schneider Electric NetBotz 4 - 355/450/455/550/570 ICS / OT

Apr 18, 2023
Medium 6.5

CVE-2022-43378

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be t…

Schneider Electric NetBotz 4 - 355/450/455/550/570 ICS / OT

Apr 18, 2023

Revision history

2023-02-14 #2.0.0
The CVSS scores were updated.
2022-11-08 #1.0.0
Original Release

References

NetBotz 4 - 355/450/455/550/570 - SEVD-2022-312-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/