CVE-2022-32748

Published: Jan 30, 2023Modified: Nov 21, 2024

8.3

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 6.0

Source: NVD

Description

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)

Affected (1)

Products: Schneider Electric: Ecostruxure Cybersecurity Admin Expert

Schneider Electric

1 product

Ecostruxure Cybersecurity Admin Expert

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Ecostruxure Cybersecurity Admin Expert	Before 2.4

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf

Source: cybersecurity@se.com

PatchVendor Advisory

https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.