CVE-2023-5630 MEDIUM

Published: 2023-12-14 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-494: Descarga de código sin verificación de integridad que podría permitir a un usuario privilegiado instalar un firmware que no es de confianza.

CVSS Metrics

Base Score: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	HIGH
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.2

Impact Score: 3.6

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-494

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	eb450_firmware	-	<built-in method update of dict object at 0x7e60a87830c0>	Operating System
schneider-electric	eb45e_firmware	-	<built-in method update of dict object at 0x7e6110f85e40>	Operating System
schneider-electric	eh450_firmware	-	<built-in method update of dict object at 0x7e60a88359c0>	Operating System
schneider-electric	eh45e_firmware	-	<built-in method update of dict object at 0x7e60a8837e80>	Operating System
schneider-electric	er450_firmware	-	<built-in method update of dict object at 0x7e60a8780400>	Operating System
schneider-electric	er45e_firmware	-	<built-in method update of dict object at 0x7e60a8780e40>	Operating System
schneider-electric	jr240_firmware	-	<built-in method update of dict object at 0x7e61116aa000>	Operating System
schneider-electric	jr900_firmware	-	<built-in method update of dict object at 0x7e6110f86840>	Operating System
schneider-electric	qr450_firmware	*	<built-in method update of dict object at 0x7e6110f85b80>	Operating System
schneider-electric	qr150_firmware	*	<built-in method update of dict object at 0x7e60a8780180>	Operating System
schneider-electric	qb450_firmware	*	<built-in method update of dict object at 0x7e60e88589c0>	Operating System
schneider-electric	qb150_firmware	*	<built-in method update of dict object at 0x7e6110f86a80>	Operating System
schneider-electric	qp450_firmware	*	<built-in method update of dict object at 0x7e60a8836400>	Operating System
schneider-electric	qp150_firmware	*	<built-in method update of dict object at 0x7e60e888fb80>	Operating System
schneider-electric	qh450_firmware	*	<built-in method update of dict object at 0x7e60eb219880>	Operating System
schneider-electric	qh150_firmware	*	<built-in method update of dict object at 0x7e60a88c2540>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eb450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eb450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eb45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eb45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eh450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eh450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eh45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eh45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:er450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:er450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:er45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:er45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:jr240_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:jr240:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:jr900_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:jr900:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qr450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qr450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qr150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qr150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qb450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qb450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qb150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qb150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qp450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qp450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qp150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qp150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qh450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qh450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qh150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qh150:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf
Source: [email protected]

Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory