Schneider-Electric
Page 3 of 9 — Schneider-Electric CVEs from a corpus of 880, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42973 | High | 7.8 | 2023-02-01 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affecte… |
CVE-2022-42972 | High | 7.8 | 2023-02-01 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifie… |
CVE-2022-42971 | Critical | 9.8 | 2023-02-01 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JS… |
CVE-2022-42970 | Critical | 9.8 | 2023-02-01 | A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identi… |
CVE-2022-2329 | Critical | 9.8 | 2023-02-01 | A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote… |
CVE-2022-24324 | Critical | 9.8 | 2023-02-01 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code ex… |
CVE-2021-22786 | High | 7.5 | 2023-02-01 | A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communi… |
CVE-2023-22611 | High | 7.5 | 2023-01-31 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are s… |
CVE-2023-22610 | Critical | 9.1 | 2023-01-31 | A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the… |
CVE-2022-45789 | High | 8.1 | 2023-01-31 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hija… |
CVE-2022-32748 | High | 7.9 | 2023-01-30 | A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure d… |
CVE-2022-32747 | High | 8.0 | 2023-01-30 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account… |
CVE-2022-32529 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32528 | High | 8.6 | 2023-01-30 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project… |
CVE-2022-32527 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32526 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32525 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32524 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32523 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32522 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32521 | High | 7.1 | 2023-01-30 | A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data i… |
CVE-2022-32520 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32519 | High | 8.0 | 2023-01-30 | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network… |
CVE-2022-32518 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32517 | Medium | 6.5 | 2023-01-30 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into inte… |
CVE-2022-32516 | High | 7.5 | 2023-01-30 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product su… |
CVE-2022-32515 | High | 8.6 | 2023-01-30 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account w… |
CVE-2022-32514 | Critical | 9.8 | 2023-01-30 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Produ… |
CVE-2022-32513 | Critical | 9.8 | 2023-01-30 | A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the passwo… |
CVE-2022-32512 | Medium | 5.3 | 2023-01-30 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command w… |
CVE-2022-22732 | Low | 3.9 | 2023-01-30 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server… |
CVE-2022-22731 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to cre… |
CVE-2022-0223 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwri… |
CVE-2022-45788 | High | 7.5 | 2023-01-30 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of c… |
CVE-2022-2988 | Medium | 4.3 | 2023-01-30 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning s… |
CVE-2022-0222 | High | 7.5 | 2022-11-22 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending… |
CVE-2022-37301 | High | 7.5 | 2022-11-22 | A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations w… |
CVE-2022-41671 | High | 7.0 | 2022-11-04 | A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privil… |
CVE-2022-41670 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversari… |
CVE-2022-41669 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges… |
CVE-2022-41668 | High | 7.0 | 2022-11-04 | A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-contro… |
CVE-2022-41667 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privilege… |
CVE-2022-41666 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL whi… |
CVE-2022-37302 | Medium | 5.5 | 2022-09-13 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software… |
CVE-2022-37300 | Critical | 9.8 | 2022-09-12 | A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the cont… |
CVE-2022-34765 | Medium | 5.5 | 2022-07-13 | A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is writ… |
CVE-2022-34764 | Medium | 5.9 | 2022-07-13 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL… |
CVE-2022-34763 | Medium | 5.9 | 2022-07-13 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verific… |
CVE-2022-34762 | Medium | 5.9 | 2022-07-13 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized firmware image load… |
CVE-2022-34761 | High | 7.5 | 2022-07-13 | A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type. Affected Product… |
CVE-2022-34760 | High | 7.5 | 2022-07-13 | A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper ha… |
CVE-2022-34759 | High | 7.5 | 2022-07-13 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers. Affected… |
CVE-2022-34758 | Medium | 5.1 | 2022-07-13 | A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged… |
CVE-2022-34757 | Medium | 6.7 | 2022-07-13 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pr… |
CVE-2022-34756 | High | 8.8 | 2022-07-13 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used… |
CVE-2022-34754 | Medium | 6.8 | 2022-07-13 | A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 Power… |
CVE-2022-34753 | High | 8.8 | 2022-07-13 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit… |
CVE-2022-32530 | Medium | 4.8 | 2022-06-24 | A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection opt… |
CVE-2022-30238 | High | 8.3 | 2022-06-02 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affecte… |
CVE-2022-30237 | High | 8.2 | 2022-06-02 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the en… |
CVE-2022-30236 | High | 8.2 | 2022-06-02 | A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Af… |
CVE-2022-30235 | High | 8.6 | 2022-06-02 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forc… |
CVE-2022-30234 | Critical | 9.4 | 2022-06-02 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Produ… |
CVE-2022-30233 | Medium | 6.5 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing ce… |
CVE-2022-30232 | High | 8.0 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a re… |
CVE-2022-26507 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This i… |
CVE-2022-0221 | Medium | 5.5 | 2022-04-13 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solu… |
CVE-2021-22797 | High | 7.8 | 2022-04-13 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed i… |
CVE-2021-22795 | Critical | 9.1 | 2022-04-13 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2021-22794 | Critical | 9.1 | 2022-04-13 | A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected P… |
CVE-2019-6834 | High | 7.3 | 2022-04-13 | A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM pr… |
CVE-2021-30066 | Medium | 6.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmwa… |
CVE-2021-30065 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus pack… |
CVE-2021-30064 | Critical | 9.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can su… |
CVE-2021-30063 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can cause an OPC enforcer… |
CVE-2021-30062 | High | 7.5 | 2022-04-03 | On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforc… |
CVE-2021-30061 | Medium | 6.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximat… |
CVE-2020-25184 | High | 7.8 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGR… |
CVE-2020-25182 | Medium | 6.7 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allo… |
CVE-2020-25180 | Medium | 5.3 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The… |
CVE-2020-25178 | High | 7.5 | 2022-03-18 | ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file sy… |
CVE-2020-25176 | Critical | 9.1 | 2022-03-18 | Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sy… |
CVE-2022-24323 | Medium | 5.3 | 2022-03-09 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon control… |
CVE-2022-24322 | Medium | 5.3 | 2022-03-09 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between… |
CVE-2021-22783 | High | 8.8 | 2022-03-09 | A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: R… |
CVE-2022-22806 | Critical | 9.8 | 2022-03-09 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection i… |
CVE-2022-22805 | Critical | 9.8 | 2022-03-09 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperl… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2021-22824 | High | 7.5 | 2022-02-11 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied… |
CVE-2021-22823 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-22806 | High | 7.5 | 2022-02-11 | A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicio… |
CVE-2021-22805 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-22804 | High | 7.5 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the con… |
CVE-2021-22803 | Critical | 9.8 | 2022-02-11 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an att… |
CVE-2021-22802 | Critical | 9.8 | 2022-02-11 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user suppl… |
CVE-2021-22801 | Critical | 9.8 | 2022-02-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially cr… |
CVE-2021-22800 | High | 7.5 | 2022-02-11 | A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controller over network port… |
CVE-2021-22798 | High | 7.5 | 2022-02-11 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is… |
CVE-2021-22796 | High | 7.8 | 2022-02-11 | A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolk… |
CVE-2021-22788 | High | 7.5 | 2022-02-11 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web serve… |