CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2021-22703
https://notcve.org/view.php?id=CVE-2021-22703
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device. Una CWE-319: Se presenta una vulnerabilidad de transmisión de información confidencial en texto sin cifrar en PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 y PM800 (consulte la notificación para las versiones afectadas), que podría causar una divulgación de las credenciales del usuario cuando un actor malicioso intercepta el tráfico de red HTTP entre un usuario y el dispositivo • https://www.se.com/ww/en/download/document/SEVD-2021-040-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2021-22702
https://notcve.org/view.php?id=CVE-2021-22702
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device. A CWE-319: Se presenta una vulnerabilidad de transmisión de información confidencial en texto sin cifrar en PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 y PM800 (consulte la notificación para las versiones afectadas), que podría causar una divulgación de credenciales de usuario cuando un actor malicioso intercepta el tráfico de red Telnet entre un usuario y el dispositivo • https://www.se.com/ww/en/download/document/SEVD-2021-040-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22698 – Schneider Electric EcoStruxure Power Build SSD File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22698
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed. CWE-434: Se presenta una vulnerabilidad de Carga Sin Restricciones de Archivo con Tipo Peligroso en el software EcoStruxure Power Build - Rapsody (versiones V2.1.13 y anteriores) que podría permitir que ocurra un desbordamiento del búfer en la región stack de la memoria que podría resultar en una ejecución de código remota cuando un archivo SSD es cargado y analizado inapropiadamente This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01 https://www.se.com/ww/en/download/document/SEVD-2021-012-02 https://www.zerodayinitiative.com/advisories/ZDI-21-187 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22697 – Schneider Electric EcoStruxure Power Build SSD File Parsing Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22697
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed. CWE-434: Se presenta una vulnerabilidad de Carga Sin Restricciones de Archivo con Tipo Peligroso en el software EcoStruxure Power Build - Rapsody (versiones V2.1.13 y anteriores) que podría permitir una condición de uso de la memoria previamente liberada que podría resultar en una ejecución de código remota cuando un archivo SSD malicioso es cargado y analizado inapropiadamente This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SSD files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01 https://www.se.com/ww/en/download/document/SEVD-2021-012-02 https://www.zerodayinitiative.com/advisories/ZDI-21-186 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 44EXPL: 0CVE-2020-28221
https://notcve.org/view.php?id=CVE-2020-28221
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. CWE-20: Se presenta una vulnerabilidad de Comprobación Inapropiada de la Entrada en EcoStruxure™ Operator Terminal Expert y Pro-face BLUE (detalles de la versión en la notificación) que podría causar una ejecución de código arbitraria cuando la funcionalidad Ethernet Download está habilitada en la HMI • https://www.se.com/ww/en/download/document/SEVD-2021-012-01 • CWE-20: Improper Input Validation •