What is CVE-2022-2988?

CVE-2022-2988 is a medium-severity vulnerability in Schneider Electric Ecostruxure Machine Expert – Hvac, classified under Out-of-bounds Write. CVSS score: 4.3/10. Published 2023-01-30.

How severe is CVE-2022-2988?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Buffer overflow in Schneider Electric Ecostruxure Machine Expert – Hvac

CVE-2022-2988

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)

Vulnerability class: Buffer Overflow

EPSS: 0.004 (35.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Schneider Electric Ecostruxure Machine Expert – Hvac — versions All
Schneider Electric Somachine Hvac — versions All
Schneider-electric Ecostruxure_machine_expert_-_hvac
Schneider-electric Somachine_hvac

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

cybersecurity@se.com (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-2988?: CVE-2022-2988 is a medium-severity vulnerability in Schneider Electric Ecostruxure Machine Expert – Hvac, classified under Out-of-bounds Write. CVSS score: 4.3/10. Published 2023-01-30.
How severe is CVE-2022-2988?: Medium severity. CVSS v3 base score is 4.3 out of 10.