CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25552
https://notcve.org/view.php?id=CVE-2023-25552
A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25548
https://notcve.org/view.php?id=CVE-2023-25548
A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured when a hacker is using a low privileged user. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25547
https://notcve.org/view.php?id=CVE-2023-25547
A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-02.pdf • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22794 – Schneider Electric Struxureware Data Center Expert Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22794
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior) Una CWE-22: Se presenta una vulnerabilidad de Limitación de un Nombre de Ruta a un Directorio Restringido ("Salto de Ruta ") que podría causar una ejecución de código remota. Producto afectado: StruxureWare Data Center Expert (versiones V7.8.1 y anteriores) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric Struxureware Data Center Expert. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • https://www.se.com/ww/en/download/document/SEVD-2021-257-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22795 – Schneider Electric Struxureware Data Center Expert Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22795
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior) Una CWE-78: Se presenta una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales Usados en un Comando del Sistema Operativo (" Inyección de Comandos del Sistema Operativo") que podría causar una ejecución de código remota cuando es llevado a cabo a través de la red. Producto afectado: StruxureWare Data Center Expert (versiones V7.8.1 y anteriores) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric Struxureware Data Center Expert. Authentication is required to exploit this vulnerability. The specific flaw exists within the testRepository method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. • https://www.se.com/ww/en/download/document/SEVD-2021-257-03 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •