CVE-2022-24320: schneider-electric clearscada Improper Certificate Validation

EPSS trend

Probability

0.54%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

0.00 pp

From 0.54% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

2 links

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05X Refsource MISCPatchVendor Advisory
github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0019/MNDT-2022-0019.mdX Refsource MISCThird Party Advisory

Related vulnerabilities

CVE-2022-24319schneider-electricclearscada0.57%4y ago09-02-2022 22:05A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)CVE-2017-6021avevaclearscada+21.67%8y ago14-05-2018 14:00In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).CVE-2019-6854schneider-electricclearscada0.17%6y ago06-01-2020 22:56A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the file system of that operating system to exploit this vulnerability. Affected versions in current support includes ClearSCADA 2017 R3, ClearSCADA 2017 R2, and ClearSCADA 2017.

All vulnerabilities inclearscada

CVE-2022-24320: schneider-electric clearscada Improper Certificate Validation

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References