What is CVE-2023-28003?

CVE-2023-28003 is a medium-severity vulnerability in Schneider Electric Ecostruxure Power Monitoring Expert, classified under Insufficient Session Expiration. CVSS score: 6.7/10. Published 2023-04-18.

How severe is CVE-2023-28003?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Vulnerability in Schneider Electric Ecostruxure Power Monitoring Expert

CVE-2023-28003

A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.

EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Schneider Electric Ecostruxure Power Monitoring Expert — versions All
Schneider-electric Ecostruxure_power_monitoring_expert

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

cybersecurity@se.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-28003?: CVE-2023-28003 is a medium-severity vulnerability in Schneider Electric Ecostruxure Power Monitoring Expert, classified under Insufficient Session Expiration. CVSS score: 6.7/10. Published 2023-04-18.
How severe is CVE-2023-28003?: Medium severity. CVSS v3 base score is 6.7 out of 10.