Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Se presenta una vulnerabilidad de Administración de Privilegios Inapropiada en Schneider Electric Modbus Serial Driver (consulte la notificación de seguridad para las versiones) que podría causar una escalada de privilegios locales cuando el servicio Modbus Serial Driver es invocado. El controlador no asigna, modifica, rastrea o comprueba apropiadamente los privilegios de un actor, creando una esfera de control no prevista para ese actor
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-269
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | modbus_driver_suite | * | <built-in method update of dict object at 0x7e60bb885b40> | Application |
| schneider-electric | modbus_serial_driver | * | <built-in method update of dict object at 0x7e60bb8859c0> | Application |
| schneider-electric | modbus_serial_driver | * | <built-in method update of dict object at 0x7e60bb884540> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:modbus_driver_suite:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:x86:* |
| Yes | cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:x64:* |