Advisories · Technology

Schneider Electric EcoStruxure Control Expert.

Every CVE that names Schneider Electric EcoStruxure Control Expert among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-27975 CVE record

CVSS 7.1 High

Insufficiently protected credentials in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- Hard-coded credentials
Not analysed yet 14 Feb 2024
CVE-2023-6408 CVE record

CVSS 8.1 High

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of c…
- Schneider Electric Modicon M340 CPU (part numbers BMXP34*)
- Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)
- CWE-924
Not analysed yet 14 Feb 2024
CVE-2023-6409 CVE record

CVSS 7.7 High

Hard-coded credentials in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- Hard-coded credentials
Not analysed yet 14 Feb 2024
CVE-2023-1548 CVE record

CVSS 5.5 Medium

Improper privilege management in Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Control Expert
- Privilege escalation
Not analysed yet 18 Apr 2023
CVE-2023-27976 CVE record

CVSS 8.8 High

Resource exposure in Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Control Expert
- Information disclosure
Not analysed yet 18 Apr 2023
CVE-2022-45789 CVE record

CVSS 8.1 High

Authentication bypass by replay in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- Authentication bypass
Not analysed yet 31 Jan 2023
CVE-2022-45788 CVE record

CVSS 7.5 High

Improper check for unusual conditions in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- CWE-754
Not analysed yet 30 Jan 2023
CVE-2022-37302 CVE record

CVSS 5.5 Medium

Buffer overflow in Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Control Expert
- Memory corruption
Not analysed yet 13 Sept 2022
CVE-2022-37300 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Weak password recovery in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- CWE-640
Not analysed yet 12 Sept 2022
CVE-2021-22797 CVE record

CVSS 7.8 HighCritical · CVSS 7+ and EPSS

Path traversal in Schneider Electric EcoStruxure Control Expert and others
- Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Process Expert
- Path traversal
Not analysed yet 28 Mar 2022
CVE-2022-24323 CVE record

CVSS 5.3 Medium

Improper check for unusual conditions in Schneider Electric EcoStruxure Process Expert and others
- Schneider Electric EcoStruxure Process Expert
- Schneider Electric EcoStruxure Control Expert
- CWE-754
Not analysed yet 9 Mar 2022
CVE-2022-24322 CVE record

CVSS 5.3 Medium

Buffer overflow in Schneider Electric EcoStruxure Control Expert
- Schneider Electric EcoStruxure Control Expert
- Memory corruption
Not analysed yet 9 Mar 2022