Paper/Archive/CVE-2023-22610

CVE-2023-22610

Schneider Electric EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) — A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific mes…

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 47.2.472 × 209.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port.

Affected

ProductAffectedFixed inSource

EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)All – < October 2022October 2022CNA

Scores by source

schneider (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf