A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert.
Se presenta una vulnerabilidad de Administración de Privilegios Inapropiado CWE-269 en el tiempo de ejecución de EcoStruxureª Operator Terminal Expert (Vijeo XD) que podría causar una escalada de privilegios en la estación de trabajo al interactuar directamente con un controlador instalado por el software de tiempo de ejecución de EcoStruxureª Operator Terminal Expert
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:L/Au:N/C:C/I:C/A:C
| Access Vector | LOCAL |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | COMPLETE |
| Integrity Impact | COMPLETE |
| Availability Impact | COMPLETE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-269
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | operator_terminal_expert_runtime | * | <built-in method update of dict object at 0x7e60a888c080> | Application |
| schneider-electric | operator_terminal_expert_runtime | 3.1 | <built-in method update of dict object at 0x7e60a888fac0> | Application |
| schneider-electric | operator_terminal_expert_runtime | 3.1 | <built-in method update of dict object at 0x7e611239d040> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:operator_terminal_expert_runtime:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:operator_terminal_expert_runtime:3.1:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:operator_terminal_expert_runtime:3.1:service_pack_1a:*:*:*:*:*:* |