A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software.
Una CWE-123: Se presenta una vulnerabilidad de Condición Write-what-where en EcoStruxure™ Control Expert (todas las versiones) y Unity Pro (nombre anterior de EcoStruxure™ Control Expert) (todas las versiones), que podría causar un bloqueo del software o una ejecución de código inesperada cuando se abre un archivo malicioso en el software EcoStruxure™ Control Expert
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-123
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_control_expert | * | <built-in method update of dict object at 0x7e60bb887640> | Application |
| schneider-electric | unity_pro | * | <built-in method update of dict object at 0x7e6110a56340> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:unity_pro:*:*:*:*:*:*:*:* |