CVE Vulnerability

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:schneider-electric:ecostruxure_cybersecurity_admin_expert:*:*:*:*:*:*:*:*
Information

Published : 2023-01-30 11:15

Updated : 2023-02-08 03:25

NVD link : CVE-2022-32748

Mitre link : CVE-2022-32748

Products Affected
No products.
CWE
CWE-295

Improper Certificate Validation