CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.
CWE-94: Existe una vulnerabilidad de Control inadecuado de la generación de código ('Inyección de código') que podría causar la ejecución de comandos no confiables en la estación de trabajo de ingeniería, lo que podría resultar en un compromiso limitado de la estación de trabajo y una posible pérdida de Confidencialidad, Integridad y Disponibilidad del sistema subsiguiente cuando un usuario autenticado abre un archivo de proyecto malicioso.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Attack Requirements | NONE |
| Privileges Required | LOW |
| User Interaction | ACTIVE |
| Vulnerability Confidentiality | LOW |
| Vulnerability Integrity | HIGH |
| Vulnerability Availability | LOW |
| Subsequent Confidentiality | HIGH |
| Subsequent Integrity | HIGH |
| Subsequent Availability | HIGH |
Source: [email protected]
Type: Secondary
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-94
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_automation_expert | * | <built-in method update of dict object at 0x7e6108405f40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_automation_expert:*:*:*:*:*:*:*:* |