A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
CWE-434: Se presenta una vulnerabilidad de Carga Sin Restricciones de Archivo con Tipo Peligroso en el software EcoStruxure Power Build - Rapsody (versiones V2.1.13 y anteriores) que podría permitir que ocurra un desbordamiento del búfer en la región stack de la memoria que podría resultar en una ejecución de código remota cuando un archivo SSD es cargado y analizado inapropiadamente
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-434
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_power_build_-_rapsody | * | <built-in method update of dict object at 0x7e60bae0fe40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:*:*:*:* |