High SEVD-2023-045-02 9 CVEs

StruxureWare Data Center Expert

Published Feb 14, 2023 · Updated Feb 14, 2023

Vendor: Schneider Electric Product: StruxureWare Data Center Expert

Summary

Schneider Electric is aware of multiple vulnerabilities in its StruxureWare Data Center Expert product.
The StruxureWare Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediations provided below may risk remote access and/or Local Privilege Escalation, which could result in loss of control and loss of availability of the appliance.

Vulnerabilities 9

High 8.8

CVE-2023-25547

A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install pa…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
High 8.8

CVE-2023-25548

A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE e…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
High 8.1

CVE-2023-25552

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or dele…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
High 7.8

CVE-2023-25554

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exis…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
High 7.2

CVE-2023-25549

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code ex…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
High 7.2

CVE-2023-25550

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execut…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
Medium 6.1

CVE-2023-25551

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on …

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
Medium 6.1

CVE-2023-25553

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on …

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023
Medium 5.6

CVE-2023-25555

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exis…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Apr 18, 2023

Revision history

2023-02-14 #1
Original Release

References

StruxureWare Data Center Expert - SEVD-2023-045-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/