Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause protected derived function blocks to be read or modified by unauthorized users when accessing a project file.
Se presenta una vulnerabilidad de credenciales insuficientemente protegidas en EcoStruxure Control Expert (todas las versiones anteriores a V15.0 SP1, incluyéndo todas las versiones de Unity Pro), EcoStruxure Process Expert (todas las versiones, incluyéndo todas las versiones de EcoStruxure Hybrid DCS) y SCADAPack RemoteConnect for x70, todas las versiones, que podría causar una lectura o modificación de bloques de función derivados protegidos por parte de usuarios no autorizados cuando se accede a un archivo de proyecto
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:L/AC:L/Au:N/C:P/I:P/A:N
| Access Vector | LOCAL |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-522
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_control_expert | * | <built-in method update of dict object at 0x7e611224cd80> | Application |
| schneider-electric | ecostruxure_control_expert | 15.0 | <built-in method update of dict object at 0x7e60e884c2c0> | Application |
| schneider-electric | ecostruxure_process_expert | * | <built-in method update of dict object at 0x7e60e884fdc0> | Application |
| schneider-electric | remoteconnect | * | <built-in method update of dict object at 0x7e61109d4840> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_process_expert:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:remoteconnect:*:*:*:*:*:*:scadapack_x70:* |