Schneider Electric Struxureware Data Center Expert vulnerabilities, page 3

49 vulnerabilities

Known vulnerabilities in Schneider Electric Struxureware Data Center Expert, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2023-25548schneider electricstruxureware data center expert+1
EPSS score
0.55%
A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured when a hacker is using a low privileged user. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)8.1CVE-2023-25555schneider electricstruxureware data center expert+1
EPSS score
0.82%
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)8.8CVE-2023-25547schneider electricstruxureware data center expert+1
EPSS score
0.94%
A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)8.1CVE-2023-25552schneider electricstruxureware data center expert+1
EPSS score
0.50%
A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)6.1CVE-2023-25553schneider electricstruxureware data center expert+1
EPSS score
0.39%
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint through the logging capabilities of the webserver. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)7.2CVE-2023-37198schneider electricstruxureware data center expert+1
EPSS score
0.86%
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.8.8CVE-2023-37196schneider electricstruxureware data center expert+1
EPSS score
0.60%
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE.8.8CVE-2023-37197schneider electricstruxureware data center expert+1
EPSS score
0.60%
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.7.2CVE-2023-37199schneider electricstruxureware data center expert+1
EPSS score
0.86%
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.