Search criteria
94 vulnerabilities found for N/A by Schneider Electric
CERTFR-2025-AVI-0676
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modbus/TCP Ethernet Modicon M340 FactoryCast module versions antérieures à 6.80 | ||
| Schneider Electric | N/A | Schneider Electric Software Update (SESU) versions antérieures à 3.0.12 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Enterprise Central versions 7.x antérieures à 7.0.2.348 | ||
| Schneider Electric | N/A | Modicon M340 X80 Ethernet Communication modules toutes versions pour la vulnérabilité CVE-2025-6625 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Enterprise Server versions 7.x antérieures à 7.0.2.348 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Enterprise Server versions 5.x antérieures à 5.0.3.17009 (CP16) | ||
| Schneider Electric | N/A | Modbus/TCP Ethernet Modicon M340 module versions antérieures à 3.60 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Workstation versions versions 6.x antérieures à 6.0.4.10001 (CP8) | ||
| Schneider Electric | N/A | M580 Global Data module toutes versions pour la vulnérabilité CVE-2025-6625 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Enterprise Central versions 5.x antérieures à 5.0.3.17009 (CP16) | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Workstation versions 7.x antérieures à 7.0.2.348 | ||
| Schneider Electric | N/A | Modicon M340 toutes versions pour la vulnérabilité CVE-2025-6625 | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Workstation versions 5.x antérieures à 5.0.3.17009 (CP16) | ||
| Schneider Electric | N/A | EcoStruxure Power Monitoring Expert (PME) versions antérieures à 2024 avec les derniers correctifs de sécurité | ||
| Schneider Electric | N/A | EcoStruxure Building Operation Enterprise Central versions 6.x antérieures à 6.0.4.10001 (CP8) |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modbus/TCP Ethernet Modicon M340 FactoryCast module versions ant\u00e9rieures \u00e0 6.80",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Software Update (SESU) versions ant\u00e9rieures \u00e0 3.0.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Enterprise Central versions 7.x ant\u00e9rieures \u00e0 7.0.2.348",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 X80 Ethernet Communication modules toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2025-6625",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Enterprise Server versions 7.x ant\u00e9rieures \u00e0 7.0.2.348",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Enterprise Server versions 5.x ant\u00e9rieures \u00e0 5.0.3.17009 (CP16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modbus/TCP Ethernet Modicon M340 module versions ant\u00e9rieures \u00e0 3.60",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Workstation versions versions 6.x ant\u00e9rieures \u00e0 6.0.4.10001 (CP8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "M580 Global Data module toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2025-6625",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Enterprise Central versions 5.x ant\u00e9rieures \u00e0 5.0.3.17009 (CP16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Workstation versions 7.x ant\u00e9rieures \u00e0 7.0.2.348",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2025-6625",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Workstation versions 5.x ant\u00e9rieures \u00e0 5.0.3.17009 (CP16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Monitoring Expert (PME) versions ant\u00e9rieures \u00e0 2024 avec les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Building Operation Enterprise Central versions 6.x ant\u00e9rieures \u00e0 6.0.4.10001 (CP8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-8448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8448"
},
{
"name": "CVE-2025-6625",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6625"
},
{
"name": "CVE-2025-54927",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54927"
},
{
"name": "CVE-2025-54923",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54923"
},
{
"name": "CVE-2025-5296",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5296"
},
{
"name": "CVE-2025-54926",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54926"
},
{
"name": "CVE-2025-8449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8449"
},
{
"name": "CVE-2025-54924",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54924"
},
{
"name": "CVE-2025-54925",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54925"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0676",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-08-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-224-05",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-224-05.pdf"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-224-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-224-02.pdf"
},
{
"published_at": "2025-08-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-224-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-224-03.pdf"
},
{
"published_at": "2025-08-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-224-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-224-04.pdf"
}
]
}
CERTFR-2025-AVI-0216
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure Panel Server versions antérieures à 2.1 | ||
| Schneider Electric | N/A | EcoStruxure Power Automation System User Interface (EPAS-UI) versions 2.x antérieures à 2.10 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure Panel Server versions ant\u00e9rieures \u00e0 2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Automation System User Interface (EPAS-UI) versions 2.x ant\u00e9rieures \u00e0 2.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-2002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2002"
},
{
"name": "CVE-2025-0813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0813"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0216",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-03-17T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2025-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-070-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-070-02.pdf"
},
{
"published_at": "2025-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-070-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-070-01.pdf"
}
]
}
CERTFR-2025-AVI-0112
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans les produits Schneider Electric. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure Process Expert 2023 versions antérieures à 4.8.0.5715 | ||
| Schneider Electric | N/A | EcoStruxure Process Expert for AVEVA System versions antérieures à 2023 pour la vulnérabilité CVE-2025-0327 | ||
| Schneider Electric | N/A | EcoStruxure Process Expert for AVEVA System versions antérieures à 2020 R2 pour la vulnérabilité CVE-2025-0327 | ||
| Schneider Electric | N/A | EcoStruxure Process Expert versions antérieures à 2020 R2 pour la vulnérabilité CVE-2025-0327 | ||
| Schneider Electric | N/A | EcoStruxure Process Expert for AVEVA System versions antérieures à 2021 pour la vulnérabilité CVE-2025-0327 | ||
| Schneider Electric | N/A | EcoStruxure Process Expert versions antérieures à 2021 pour la vulnérabilité CVE-2025-0327 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure Process Expert 2023 versions ant\u00e9rieures \u00e0 4.8.0.5715",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert for AVEVA System versions ant\u00e9rieures \u00e0 2023 pour la vuln\u00e9rabilit\u00e9 CVE-2025-0327",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert for AVEVA System versions ant\u00e9rieures \u00e0 2020 R2 pour la vuln\u00e9rabilit\u00e9 CVE-2025-0327",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 2020 R2 pour la vuln\u00e9rabilit\u00e9 CVE-2025-0327",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert for AVEVA System versions ant\u00e9rieures \u00e0 2021 pour la vuln\u00e9rabilit\u00e9 CVE-2025-0327",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 2021 pour la vuln\u00e9rabilit\u00e9 CVE-2025-0327",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-0327",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0327"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0112",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-11T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Schneider Electric. Elle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2025-02-10",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-042-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-042-03.pdf"
}
]
}
CERTFR-2025-AVI-0034
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | BMXNOE0110 toutes versions pour la vulnérabilité CVE-2024-12142 | ||
| Schneider Electric | N/A | Modicon M580/Quantum communication modules BMXCRA BMXCRA31200 toutes versions pour la vulnérabilité CVE-2021-29999 | ||
| Schneider Electric | N/A | EcoStruxureTM Control Expert Asset Link versions antérieures à 4.0 SP1 pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Modicon Quantum communication modules 140CRA 140CRA31200 toutes versions pour la vulnérabilité CVE-2021-29999 | ||
| Schneider Electric | N/A | Modicon M340 processors (part numbers BMXP34*) toutes versions pour la vulnérabilité CVE-2024-12142 | ||
| Schneider Electric | N/A | EcoStruxureTM Machine SCADA Expert Asset Link toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Pro-face GP-Pro EX toutes versions pour la vulnérabilité CVE-2024-12399 | ||
| Schneider Electric | N/A | BMENOR2200H toutes versions pour la vulnérabilité CVE-2024-11425 | ||
| Schneider Electric | N/A | EcoStruxure OPC UA Server Expert toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | EcoStruxureTM Process Expert toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Pro-face Remote HMI toutes versions pour la vulnérabilité CVE-2024-12399 | ||
| Schneider Electric | N/A | EcoStruxureTM Control Expert versions antérieures à 16.1 | ||
| Schneider Electric | N/A | EcoStruxure Machine Expert including EcoStruxureTM Machine Expert Safety toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | EVLink Pro AC versions antérieures à 1.3.10 | ||
| Schneider Electric | N/A | Modicon M580 CPU (part numbers BMEP* et BMEH*, excluding M580 CPU Safety) versions antérieures à 4.30 pour la vulnérabilité CVE-2024-11425 | ||
| Schneider Electric | N/A | EcoStruxure Machine Expert Twin toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | BMXNOR0200H versions antérieures à 1.70IR26 | ||
| Schneider Electric | N/A | EcoStruxure Operator Terminal Expert toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Modicon M580/Quantum communication modules BMXCRA BMXCRA31210 toutes versions pour la vulnérabilité CVE-2021-29999 | ||
| Schneider Electric | N/A | BMXNOE0100 toutes versions pour la vulnérabilité CVE-2024-12142 | ||
| Schneider Electric | N/A | Vijeo Designer toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Modicon M580 CPU Safety (part numbers BMEP58*S et BMEH58*S) versions antérieures à 4.21 pour la vulnérabilité CVE-2024-11425 | ||
| Schneider Electric | N/A | Zelio Soft 2 toutes versions pour la vulnérabilité CVE-2024-2658 | ||
| Schneider Electric | N/A | Modicon M580 communication modules BMENOC BMENOC0321 versions antérieures à 1.10 | ||
| Schneider Electric | N/A | EcoStruxure Architecture Builder versions antérieures à 7.0.18 | ||
| Schneider Electric | N/A | Modicon Quantum communication modules 140CRA 140CRA31908 toutes versions pour la vulnérabilité CVE-2021-29999 | ||
| Schneider Electric | N/A | Modicon M580 communication modules BMECRA BMECRA31210 toutes versions pour la vulnérabilité CVE-2021-29999 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "BMXNOE0110 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-12142",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580/Quantum communication modules BMXCRA BMXCRA31200 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2021-29999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxureTM Control Expert Asset Link versions ant\u00e9rieures \u00e0 4.0 SP1 pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum communication modules 140CRA 140CRA31200 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2021-29999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 processors (part numbers BMXP34*) toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-12142",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxureTM Machine SCADA Expert Asset Link toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Pro-face GP-Pro EX toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-12399",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMENOR2200H toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-11425",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure OPC UA Server Expert toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxureTM Process Expert toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Pro-face Remote HMI toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-12399",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxureTM Control Expert versions ant\u00e9rieures \u00e0 16.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Machine Expert including EcoStruxureTM Machine Expert Safety toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EVLink Pro AC versions ant\u00e9rieures \u00e0 1.3.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 CPU (part numbers BMEP* et BMEH*, excluding M580 CPU Safety) versions ant\u00e9rieures \u00e0 4.30 pour la vuln\u00e9rabilit\u00e9 CVE-2024-11425",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Machine Expert Twin toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMXNOR0200H versions ant\u00e9rieures \u00e0 1.70IR26",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Operator Terminal Expert toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580/Quantum communication modules BMXCRA BMXCRA31210 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2021-29999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMXNOE0100 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-12142",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Vijeo Designer toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 CPU Safety (part numbers BMEP58*S et BMEH58*S) versions ant\u00e9rieures \u00e0 4.21 pour la vuln\u00e9rabilit\u00e9 CVE-2024-11425",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Zelio Soft 2 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-2658",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 communication modules BMENOC BMENOC0321 versions ant\u00e9rieures \u00e0 1.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Architecture Builder versions ant\u00e9rieures \u00e0 7.0.18",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum communication modules 140CRA 140CRA31908 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2021-29999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 communication modules BMECRA BMECRA31210 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2021-29999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-12399",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12399"
},
{
"name": "CVE-2024-11139",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11139"
},
{
"name": "CVE-2021-29999",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29999"
},
{
"name": "CVE-2024-11425",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11425"
},
{
"name": "CVE-2024-2658",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2658"
},
{
"name": "CVE-2024-12142",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12142"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0034",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-01-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-01.pdf"
},
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-02.pdf"
},
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-09",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-09\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-09.pdf"
},
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-03.pdf"
},
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-07",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-07\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-07.pdf"
},
{
"published_at": "2025-01-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2025-014-05",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-014-05.pdf"
}
]
}
CERTFR-2024-AVI-1053
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon Controllers M251 toutes versions pour la vulnérabilité CVE-2024-11737 | ||
| Schneider Electric | N/A | Modicon Controllers M241 toutes versions pour la vulnérabilité CVE-2024-11737 | ||
| Schneider Electric | N/A | PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series runtme Pro-face BLUE pour la vulnérabilité CVE-2024-11999 | ||
| Schneider Electric | N/A | Harmony/Magelis HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series avec runtime EcoStruxureTM Operator Terminal Expert pour la vulnérabilité CVE-2024-11999 | ||
| Schneider Electric | N/A | Modicon Controllers LMC058 toutes versions pour la vulnérabilité CVE-2024-11737 | ||
| Schneider Electric | N/A | Modicon Controllers M258 toutes versions pour la vulnérabilité CVE-2024-11737 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon Controllers M251 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-11737",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controllers M241 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-11737",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series runtme Pro-face BLUE pour la vuln\u00e9rabilit\u00e9 CVE-2024-11999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Harmony/Magelis HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series avec runtime EcoStruxureTM Operator Terminal Expert pour la vuln\u00e9rabilit\u00e9 CVE-2024-11999",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controllers LMC058 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-11737",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controllers M258 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-11737",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-11999",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11999"
},
{
"name": "CVE-2024-11737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11737"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-1053",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-345-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-345-02.pdf"
},
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-345-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-345-03.pdf"
}
]
}
CERTFR-2024-AVI-0961
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon Momentum Unity M1E Processor (identifiants 171CBU*) toutes versions | ||
| Schneider Electric | N/A | EcoStruxure IT Gateway versions antérieures à 1.23.1.10 | ||
| Schneider Electric | N/A | Modicon M340 CPU (identifiants BMXP34*) toutes versions | ||
| Schneider Electric | N/A | Modicon MC80 (identifiants BMKC80) toutes versions |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon Momentum Unity M1E Processor (identifiants 171CBU*) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure IT Gateway versions ant\u00e9rieures \u00e0 1.23.1.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 CPU (identifiants BMXP34*) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon MC80 (identifiants BMKC80) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-8935",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8935"
},
{
"name": "CVE-2024-8933",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8933"
},
{
"name": "CVE-2024-8937",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8937"
},
{
"name": "CVE-2024-10575",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-10575"
},
{
"name": "CVE-2024-8936",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8936"
},
{
"name": "CVE-2024-8938",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8938"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0961",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-317-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-317-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-317-04.pdf"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-317-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-317-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-317-02.pdf"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-317-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-317-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-317-03.pdf"
}
]
}
CERTFR-2024-AVI-0845
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Harmony iPC – HMIBSC IIoT Edge Box Core (cette famille de produits est en fin de vie et ne recevra plus de correctifs de sécurité) | ||
| Schneider Electric | N/A | EVlink Home Smart versions antérieures à 2.0.6.0.0 | ||
| Schneider Electric | N/A | System Monitor application dans les séries Harmony Industrial PC HMIBMO/HMIBMI/HMIPSO/HMIBMP/HMIBMU/HMIPSP/HMIPEP toutes versions, aucun correctif n'est disponible, l'éditeur recommande de désinstaller le composant | ||
| Schneider Electric | N/A | Schneider Charge versions antérieures à 1.13.4 | ||
| Schneider Electric | N/A | Zelio Soft 2 versions antérieures à 5.4.2.2 | ||
| Schneider Electric | N/A | EcoStruxure EV Charging Expert versions antérieures à V6.0.0 | ||
| Schneider Electric | N/A | Easergy Studio versions antérieures à 9.3.4 | ||
| Schneider Electric | N/A | System Monitor application dans les séries Pro-face Industrial PC PS5000 toutes versions, aucun correctif n'est disponible, l'éditeur recommande de désinstaller le composant | ||
| Schneider Electric | N/A | EcoStruxure Power Monitoring Expert (PME) versions 2022 sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | EcoStruxure IT Data Center Expert versions antérieures à 8.2 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Harmony iPC \u2013 HMIBSC IIoT Edge Box Core (cette famille de produits est en fin de vie et ne recevra plus de correctifs de s\u00e9curit\u00e9)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EVlink Home Smart versions ant\u00e9rieures \u00e0 2.0.6.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "System Monitor application dans les s\u00e9ries Harmony Industrial PC HMIBMO/HMIBMI/HMIPSO/HMIBMP/HMIBMU/HMIPSP/HMIPEP toutes versions, aucun correctif n\u0027est disponible, l\u0027\u00e9diteur recommande de d\u00e9sinstaller le composant",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Charge versions ant\u00e9rieures \u00e0 1.13.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Zelio Soft 2 versions ant\u00e9rieures \u00e0 5.4.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure EV Charging Expert versions ant\u00e9rieures \u00e0 V6.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easergy Studio versions ant\u00e9rieures \u00e0 9.3.4 ",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "System Monitor application dans les s\u00e9ries Pro-face Industrial PC PS5000 toutes versions, aucun correctif n\u0027est disponible, l\u0027\u00e9diteur recommande de d\u00e9sinstaller le composant",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Monitoring Expert (PME) versions 2022 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure IT Data Center Expert versions ant\u00e9rieures \u00e0 8.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-8518",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8518"
},
{
"name": "CVE-2024-8531",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8531"
},
{
"name": "CVE-2024-8884",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8884"
},
{
"name": "CVE-2024-8070",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8070"
},
{
"name": "CVE-2024-9002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9002"
},
{
"name": "CVE-2024-9005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9005"
},
{
"name": "CVE-2024-8530",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8530"
},
{
"name": "CVE-2024-8422",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8422"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0845",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-08T00:00:00.000000"
},
{
"description": "Ajout du bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-04 du 10 octobre 2024.",
"revision_date": "2024-10-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-03.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-08",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-08\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-08.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-05",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-05.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-06",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-06.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-04.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-01.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-02.pdf"
},
{
"published_at": "2024-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-282-07",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-07\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-282-07.pdf"
}
]
}
CERTFR-2024-AVI-0673
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | BLUE Open Studio versions antérieures à 2020 SP3 HF1 | ||
| Schneider Electric | N/A | Accutech Manager versions antérieures à 2.10.0 | ||
| Schneider Electric | N/A | EcoStruxure Machine SCADA Expert versions antérieures à 2020 SP3 HF1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "BLUE Open Studio versions ant\u00e9rieures \u00e0 2020 SP3 HF1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Accutech Manager versions ant\u00e9rieures \u00e0 2.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Machine SCADA Expert versions ant\u00e9rieures \u00e0 2020 SP3 HF1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-6132",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6132"
},
{
"name": "CVE-2024-6918",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6918"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0673",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-226-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-226-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-226-01.pdf"
},
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-226-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-226-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-226-02.pdf"
}
]
}
CERTFR-2024-AVI-0549
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans les produits Schneider Electric. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que le correctif n'est pas encore disponible pour la vulnérabilité CVE-2024-6528. Cependant, des actions sont proposées pour réduire le risque d'exploitation.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon Controllers M258 / LMC058 toutes versions pour la vulnérabilité CVE-2024-6528 | ||
| Schneider Electric | N/A | Modicon Controllers M241 / M251 toutes versions pour la vulnérabilité CVE-2024-6528 | ||
| Schneider Electric | N/A | Modicon Controllers M262 toutes versions pour la vulnérabilité CVE-2024-6528 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon Controllers M258 / LMC058 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-6528",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controllers M241 / M251 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-6528",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controllers M262 toutes versions pour la vuln\u00e9rabilit\u00e9 CVE-2024-6528",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que le correctif n\u0027est pas encore disponible pour la vuln\u00e9rabilit\u00e9 CVE-2024-6528. Cependant, des actions sont propos\u00e9es pour r\u00e9duire le risque d\u0027exploitation.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-6528",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6528"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0549",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Schneider Electric. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-191-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-191-04.pdf"
}
]
}
CERTFR-2024-AVI-0476
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | Sage 2400 | Sage 2400 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 toutes versions | ||
| Schneider Electric | Sage 1450 | Sage 1450 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 1430 | Sage 1430 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 3030 Magnum | Sage 3030 Magnum avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 1410 | Sage 1410 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | EVlink Home Smart | EVlink Home Smart versions 2.0.4.1.2_131 et 2.0.3.8.2_128 antérieures à 2.0.5.0.0_134 | ||
| Schneider Electric | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | ||
| Schneider Electric | Modicon M340 | Modicon M340 toutes versions | ||
| Schneider Electric | PowerLogic P5 | PowerLogic P5 versions antérieures à 02.501.101 | ||
| Schneider Electric | Sage 4400 | Sage 4400 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | N/A | SpaceLogic AS-P et SpaceLogic AS-B versions antérieures à 6.0.1 ou versions 5.0.3 et 4.0.5 sans le dernier correctif de sécurité | ||
| Schneider Electric | Network module, Modicon M340, Modbus/TCP BMXNOE0100 | Network module, Modicon M340 et Modbus/TCP BMXNOE0100 toutes versions |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Sage 2400 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 2400",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 toutes versions",
"product": {
"name": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1450 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1450",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1430 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1430",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 3030 Magnum avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 3030 Magnum",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1410 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1410",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EVlink Home Smart versions 2.0.4.1.2_131 et 2.0.3.8.2_128 ant\u00e9rieures \u00e0 2.0.5.0.0_134",
"product": {
"name": "EVlink Home Smart",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"product": {
"name": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 toutes versions",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PowerLogic P5 versions ant\u00e9rieures \u00e0 02.501.101",
"product": {
"name": "PowerLogic P5",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 4400 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 4400",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SpaceLogic AS-P et SpaceLogic AS-B versions ant\u00e9rieures \u00e0 6.0.1 ou versions 5.0.3 et 4.0.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Modbus/TCP BMXNOE0100 toutes versions",
"product": {
"name": "Network module, Modicon M340, Modbus/TCP BMXNOE0100",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-5557",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5557"
},
{
"name": "CVE-2024-37039",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37039"
},
{
"name": "CVE-2024-5558",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5558"
},
{
"name": "CVE-2024-5056",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5056"
},
{
"name": "CVE-2024-37037",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37037"
},
{
"name": "CVE-2024-5559",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5559"
},
{
"name": "CVE-2024-5313",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5313"
},
{
"name": "CVE-2024-37038",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37038"
},
{
"name": "CVE-2024-37040",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37040"
},
{
"name": "CVE-2024-5560",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5560"
},
{
"name": "CVE-2024-37036",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37036"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0476",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-06-11T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE.",
"revision_date": "2024-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-02.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-01.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-03.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-05",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
]
}
CERTFR-2024-AVI-0282
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans les produits Schneider. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Easergy Studio versions antérieures à v9.3.3 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Easergy Studio versions ant\u00e9rieures \u00e0 v9.3.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-2747",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2747"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0282",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-09T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits Schneider\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\n\u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Schneider",
"vendor_advisories": [
{
"published_at": "2024-04-09",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2024-100-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-100-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2024-100-01.pdf"
}
]
}
CERTFR-2024-AVI-0120
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) toutes versions | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure™ Control Expert versions antérieures à v16.0 | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure IT Gateway versions antérieures à 1.20.0 | ||
| Schneider Electric | N/A | Schneider Electric Modicon M540 microgiciel versions antérieures à v3.60 | ||
| Symfony | process | Schneider Electric EcoStruxure™ Process Expert versions antérieures à v2023 | ||
| Schneider Electric | N/A | Schneider Electric Modicon M580 microgiciel versions antérieures à v4.20 | ||
| Schneider Electric | N/A | Schneider Electric Harmony Control Relay RMNF22TB30 toutes versions | ||
| Schneider Electric | Modicon M340 | Schneider Electric Modicon M340 CPU (part numbers BMXP34*) versions antérieures à sv3.60 | ||
| Schneider Electric | N/A | Schneider Electric Harmony Timer Relay RENF22R2MMW toutes versions | ||
| Schneider Electric | N/A | Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) versions antérieures à sv4.20 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure\u2122 Control Expert versions ant\u00e9rieures \u00e0 v16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure IT Gateway versions ant\u00e9rieures \u00e0 1.20.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Modicon M540 microgiciel versions ant\u00e9rieures \u00e0 v3.60",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure\u2122 Process Expert versions ant\u00e9rieures \u00e0 v2023",
"product": {
"name": "process",
"vendor": {
"name": "Symfony",
"scada": false
}
}
},
{
"description": "Schneider Electric Modicon M580 microgiciel versions ant\u00e9rieures \u00e0 v4.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Harmony Control Relay RMNF22TB30 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Modicon M340 CPU (part numbers BMXP34*) versions ant\u00e9rieures \u00e0 sv3.60",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Harmony Timer Relay RENF22R2MMW toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) versions ant\u00e9rieures \u00e0 sv4.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-6408",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6408"
},
{
"name": "CVE-2023-27975",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27975"
},
{
"name": "CVE-2018-7855",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7855"
},
{
"name": "CVE-2024-0568",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0568"
},
{
"name": "CVE-2023-6409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6409"
},
{
"name": "CVE-2024-0865",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0865"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0120",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Schneider\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2024-044-03 du 13 f\u00e9vrier 2024",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-03.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2024-044-01 du 13 f\u00e9vrier 2024",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-01.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-134-11 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-134-11\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2019-134-11_Modicon_Controllers_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2024-044-02 du 13 f\u00e9vrier 2024",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-044-02.pdf"
}
]
}
CERTFR-2024-AVI-0013
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Easergy Studio versions antérieures à v9.3.5 | ||
| Schneider Electric | N/A | Magelis XBT | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à sv4.20 | ||
| Schneider Electric | N/A | EcoStruxure Control Expert versions antérieures à v16.0 | ||
| Schneider Electric | N/A | Harmony/Magelis HMISCU versions antérieures à 6.3.1 | ||
| Schneider Electric | N/A | contrôleurs PacDrive sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | PowerLogic T300, MiCOM C264 D7.21 (et ultérieures) ou Easergy C5 1.1.6 (et ultérieures), PACiS GTW et EPAS GTW sans les dernières mesures de contournement | ||
| Schneider Electric | N/A | contrôleurs Modicon M241, M251 et M262, HMISCU et EcoStruxure Machine Expert sans les derniers correctifs de sécurité et mesures de contournement |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Easergy Studio versions ant\u00e9rieures \u00e0 v9.3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Magelis XBT",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 sv4.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 v16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Harmony/Magelis HMISCU versions ant\u00e9rieures \u00e0 6.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "contr\u00f4leurs PacDrive sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PowerLogic T300, MiCOM C264 D7.21 (et ult\u00e9rieures) ou Easergy C5 1.1.6 (et ult\u00e9rieures), PACiS GTW et EPAS GTW sans les derni\u00e8res mesures de contournement",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "contr\u00f4leurs Modicon M241, M251 et M262, HMISCU et EcoStruxure Machine Expert sans les derniers correctifs de s\u00e9curit\u00e9 et mesures de contournement",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-4046",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
},
{
"name": "CVE-2023-7032",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7032"
},
{
"name": "CVE-2023-27976",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27976"
},
{
"name": "CVE-2023-1548",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1548"
},
{
"name": "CVE-2020-25176",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25176"
},
{
"name": "CVE-2020-25178",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25178"
},
{
"name": "CVE-2023-28355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
},
{
"name": "CVE-2022-4224",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4224"
},
{
"name": "CVE-2020-25180",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25180"
},
{
"name": "CVE-2019-6833",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6833"
},
{
"name": "CVE-2020-25184",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25184"
},
{
"name": "CVE-2020-25182",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25182"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0013",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-01-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-225-01 du 13 ao\u00fbt 2019",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-225-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2019-225-01.json"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-009-02 du 09 janvier 2024",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-009-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-009-02.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-03 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-03.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-06 du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-01 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-192-04 du 11 juillet 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-159-04 du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-159-04_ISaGRAF_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-159-04 du 08 juin 2021",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-159-04_ISaGRAF_Security_Notification.pdf"
}
]
}
CERTFR-2023-AVI-1014
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Schneider Electric Trio J-Series Ethernet Data Radio toutes versions | ||
| Schneider Electric | N/A | Schneider Electric Trio Q-Series Ethernet Data Radio toutes versions | ||
| Schneider Electric | N/A | Schneider Electric Trio E-Series Ethernet Data Radio toutes versions | ||
| Schneider Electric | N/A | Schneider Electric Easy UPS Online Monitoring versions antérieures à 2.6-GA-01-23248 pour Windows 10, 11, Windows Server 2016, 2019 et 2022 | ||
| Schneider Electric | N/A | Plant iT/Brewmaxx versions supérieures ou égales à v9.60 sans le dernier correctif de sécurité disponible via ProLeiT Support |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Schneider Electric Trio J-Series Ethernet Data Radio toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Trio Q-Series Ethernet Data Radio toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Trio E-Series Ethernet Data Radio toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Easy UPS Online Monitoring versions ant\u00e9rieures \u00e0 2.6-GA-01-23248 pour Windows 10, 11, Windows Server 2016, 2019 et 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Plant iT/Brewmaxx versions sup\u00e9rieures ou \u00e9gales \u00e0 v9.60 sans le dernier correctif de s\u00e9curit\u00e9 disponible via ProLeiT Support",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-0543",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0543"
},
{
"name": "CVE-2023-5629",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5629"
},
{
"name": "CVE-2023-6407",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6407"
},
{
"name": "CVE-2023-5630",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5630"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-1014",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-12-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2023-12-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-346-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-346-03.pdf"
},
{
"published_at": "2023-11-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-346-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-02\u0026Sp_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-346-02.pdf"
},
{
"published_at": "2023-12-12",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-346-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-346-01.pdf"
}
]
}
CERTFR-2023-AVI-0933
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | PowerLogic ION8650 toutes versions sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | Schneider Electric Galaxy VL version 12.21 | ||
| Schneider Electric | N/A | Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power Operation versions 2020 antérieures à 2020 CU3 | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power Monitoring Expert (PME) versions 2021 antérieures à 2021 CU2 | ||
| Schneider Electric | N/A | Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power Operation versions 2021 antérieures à 2021 CU2 | ||
| Schneider Electric | N/A | Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power SCADA Operation (PSO) versions 2020 antérieures à 2020 CU3 | ||
| Schneider Electric | N/A | PowerLogic ION8800 toutes versions sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power Monitoring Expert (PME) versions 2020 antérieures à 2020 CU3 | ||
| Schneider Electric | N/A | Schneider Electric Galaxy VS version 6.82 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PowerLogic ION8650 toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Galaxy VL version 12.21",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power Operation versions 2020 ant\u00e9rieures \u00e0 2020 CU3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure Power Monitoring Expert (PME) versions 2021 ant\u00e9rieures \u00e0 2021 CU2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power Operation versions 2021 ant\u00e9rieures \u00e0 2021 CU2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Advanced Reporting and Dashboards Module for EcoStruxure Power SCADA Operation (PSO) versions 2020 ant\u00e9rieures \u00e0 2020 CU3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PowerLogic ION8800 toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure Power Monitoring Expert (PME) versions 2020 ant\u00e9rieures \u00e0 2020 CU3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Galaxy VS version 6.82",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-5986",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5986"
},
{
"name": "CVE-2023-6032",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6032"
},
{
"name": "CVE-2023-5987",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5987"
},
{
"name": "CVE-2023-5984",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5984"
},
{
"name": "CVE-2023-5985",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5985"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0933",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-11-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2023-11-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-318-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-318-03.pdf"
},
{
"published_at": "2023-11-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-318-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-318-02.pdf"
},
{
"published_at": "2023-11-14",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-318-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-318-01.pdf"
}
]
}
CERTFR-2023-AVI-0818
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power SCADA Operation with Advanced Reports toutes versions sans le correctif de sécurité Hotfix-145271 Hotfix-145271 | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power Operation (EPO) with Advanced Reports toutes versions sans le correctif de sécurité Hotfix-145271 Hotfix-145271 | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power Monitoring Expert (PME) toutes versions sans le correctif de sécurité Hotfix-145271 Hotfix-145271 | ||
| Schneider Electric | N/A | Schneider Electric SpaceLogic C-Bus Toolkit versions antérieures à 1.16.4 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Schneider Electric EcoStruxure Power SCADA Operation with Advanced Reports toutes versions sans le correctif de s\u00e9curit\u00e9 Hotfix-145271 Hotfix-145271",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure Power Operation (EPO) with Advanced Reports toutes versions sans le correctif de s\u00e9curit\u00e9 Hotfix-145271 Hotfix-145271",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure Power Monitoring Expert (PME) toutes versions sans le correctif de s\u00e9curit\u00e9 Hotfix-145271 Hotfix-145271",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric SpaceLogic C-Bus Toolkit versions ant\u00e9rieures \u00e0 1.16.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-5399",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5399"
},
{
"name": "CVE-2023-5391",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5391"
},
{
"name": "CVE-2023-5402",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5402"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0818",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Schneider\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-283-02 du 10 octobre 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-283-02.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-283-01 du 10 octobre 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-283-01.pdf"
}
]
}
CERTFR-2023-AVI-0732
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans les produits Schneider. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Schneider Electric IGSS Update Service versions antérieures à 16.0.0.23212 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Schneider Electric IGSS Update Service versions ant\u00e9rieures \u00e0 16.0.0.23212",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-4516",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4516"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0732",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-09-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits Schneider\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2023-255-01 du 12 septembre 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-255-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-255-01.pdf"
}
]
}
CERTFR-2023-AVI-0632
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure™ Process Expert toutes versions | ||
| Schneider Electric | N/A | Harmony et Easy Harmony, Vijeo Designer embarqué dans EcoStruxure™ Machine Expert toutes versions | ||
| Schneider Electric | N/A | GP-Pro EX WinGP pour iPC et PC/AT versions antérieures à 4.09.500 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure\u2122 Process Expert toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Harmony et Easy Harmony, Vijeo Designer embarqu\u00e9 dans EcoStruxure\u2122 Machine Expert toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "GP-Pro EX WinGP pour iPC et PC/AT versions ant\u00e9rieures \u00e0 4.09.500",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-37549",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37549"
},
{
"name": "CVE-2023-3953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3953"
},
{
"name": "CVE-2023-37550",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37550"
},
{
"name": "CVE-2023-37556",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37556"
},
{
"name": "CVE-2022-4046",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
},
{
"name": "CVE-2023-37558",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37558"
},
{
"name": "CVE-2023-3662",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3662"
},
{
"name": "CVE-2023-37559",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37559"
},
{
"name": "CVE-2023-37548",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37548"
},
{
"name": "CVE-2023-37545",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37545"
},
{
"name": "CVE-2023-37557",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37557"
},
{
"name": "CVE-2023-37555",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37555"
},
{
"name": "CVE-2023-28355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
},
{
"name": "CVE-2023-3670",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3670"
},
{
"name": "CVE-2023-37553",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37553"
},
{
"name": "CVE-2023-3669",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3669"
},
{
"name": "CVE-2022-45789",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45789"
},
{
"name": "CVE-2023-37554",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37554"
},
{
"name": "CVE-2022-45788",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45788"
},
{
"name": "CVE-2023-37552",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37552"
},
{
"name": "CVE-2023-37551",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37551"
},
{
"name": "CVE-2023-37546",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37546"
},
{
"name": "CVE-2023-37547",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37547"
},
{
"name": "CVE-2023-3663",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3663"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0632",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-08-08T00:00:00.000000"
},
{
"description": "Ajoout des vuln\u00e9rabilit\u00e9s list\u00e9es par CODESYS.",
"revision_date": "2023-08-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-192-04 du 8 ao\u00fbt 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-06 du 8 ao\u00fbt 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-05 du 8 ao\u00fbt 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-220-01 du 8 ao\u00fbt 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-220-01.pdf"
}
]
}
CERTFR-2023-AVI-0452
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | APC Easy UPS Online Monitoring Software Windows 10, 11, Windows Server 2016, 2019 et 2022 versions antérieures à 2.6-GA-01-23116 | ||
| Schneider Electric | N/A | Schneider Electric Easy UPS Online Monitoring Software Windows 10, 11, Windows Server 2016, 2019 et 2022 versions antérieures à 2.6-GA-01-23116 | ||
| Schneider Electric | N/A | Foxboro SCADA toutes versions | ||
| Schneider Electric | N/A | EcoStruxure Foxboro DCS Control Core Services toutes versions sans le correctif HF9857795 | ||
| Schneider Electric | N/A | IGSS Dashboard versions antérieures à 16.0.0.23131 | ||
| Schneider Electric | N/A | EcoStruxure Operation Terminal Expert versions antérieures à 3.4 | ||
| Schneider Electric | N/A | Pro-face BLUE versions antérieures à 3.4 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "APC Easy UPS Online Monitoring Software Windows 10, 11, Windows Server 2016, 2019 et 2022 versions ant\u00e9rieures \u00e0 2.6-GA-01-23116",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Easy UPS Online Monitoring Software Windows 10, 11, Windows Server 2016, 2019 et 2022 versions ant\u00e9rieures \u00e0 2.6-GA-01-23116",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Foxboro SCADA toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Foxboro DCS Control Core Services toutes versions sans le correctif HF9857795",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Dashboard versions ant\u00e9rieures \u00e0 16.0.0.23131",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Operation Terminal Expert versions ant\u00e9rieures \u00e0 3.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Pro-face BLUE versions ant\u00e9rieures \u00e0 3.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-29413",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29413"
},
{
"name": "CVE-2023-1049",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1049"
},
{
"name": "CVE-2023-29412",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29412"
},
{
"name": "CVE-2023-3001",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3001"
},
{
"name": "CVE-2023-29411",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29411"
},
{
"name": "CVE-2023-2569",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2569"
},
{
"name": "CVE-2023-2570",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2570"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0452",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-164-02 du 13 juin 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-164-02.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-04 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-164-01 du 13 juin 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-164-01.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-164-04 du 13 juin 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-164-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-164-03 du 13 juin 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-164-03.pdf"
}
]
}
CERTFR-2023-AVI-0297
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon M580 NOC Control (BMENOC0321) versions antérieures à 1.8 | ||
| Schneider Electric | N/A | PacDrive 3 Controllers LMC | ||
| Schneider Electric | N/A | Easergy Builder installer versions antérieures à V1.7.24 | ||
| Schneider Electric | N/A | Modicon Controller LMC058 | ||
| Schneider Electric | N/A | Modicon Controller M258 | ||
| Schneider Electric | N/A | Eco/Pro/Pro2 | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à SV4.10 | ||
| Schneider Electric | Modicon M340 | Modicon Modicon M340 CPU (part numbers BMXP34*) versions antérieures à SV3.51 | ||
| Schneider Electric | N/A | Modicon Controller M262 | ||
| Schneider Electric | N/A | PacDrive Controller LMC078 | ||
| Schneider Electric | N/A | Modicon Controller M241 | ||
| Schneider Electric | N/A | InsightHome, InsightFacility et Conext Gateway versions antérieures à 1.17 Build 079 | ||
| Schneider Electric | N/A | EcoStruxure Control Expert versions antérieures à V15.3 | ||
| Schneider Electric | N/A | Schneider Electric Easy UPS Online versions antérieures à 2.6-GS | ||
| Schneider Electric | N/A | Modicon Controller M218 | ||
| Schneider Electric | N/A | HMISCU Controller | ||
| Schneider Electric | N/A | Modicon Controller M251 | ||
| Schneider Electric | N/A | Easy Harmony ET6 (HMIET Series) et Easy Harmony GXU (HMIGXU Series) avec Vijeo Designer Basic versions antérieures à V1.2.1 Hotfix 4 | ||
| Schneider Electric | N/A | APC Easy UPS Online Monitoring versions antérieures à 2.6-GA | ||
| Schneider Electric | N/A | Modicon M580 Ethernet Communication Modules (BMENOC0301 et BMENOC0311) versions antérieures à SV2.21 | ||
| Schneider Electric | Modicon M340 | Modicon M340 CPU versions antérieures à SV3.51 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon M580 NOC Control (BMENOC0321) versions ant\u00e9rieures \u00e0 1.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive 3 Controllers LMC",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easergy Builder installer versions ant\u00e9rieures \u00e0 V1.7.24",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller LMC058",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller M258",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Eco/Pro/Pro2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 SV4.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Modicon M340 CPU (part numbers BMXP34*) versions ant\u00e9rieures \u00e0 SV3.51",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller M262",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Controller LMC078",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller M241",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "InsightHome, InsightFacility et Conext Gateway versions ant\u00e9rieures \u00e0 1.17 Build 079",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 V15.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Easy UPS Online versions ant\u00e9rieures \u00e0 2.6-GS",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller M218",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "HMISCU Controller",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Controller M251",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easy Harmony ET6 (HMIET Series) et Easy Harmony GXU (HMIGXU Series) avec Vijeo Designer Basic versions ant\u00e9rieures \u00e0 V1.2.1 Hotfix 4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "APC Easy UPS Online Monitoring versions ant\u00e9rieures \u00e0 2.6-GA",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 Ethernet Communication Modules (BMENOC0301 et BMENOC0311) versions ant\u00e9rieures \u00e0 SV2.21",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 CPU versions ant\u00e9rieures \u00e0 SV3.51",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-29413",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29413"
},
{
"name": "CVE-2023-29410",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29410"
},
{
"name": "CVE-2020-35198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
},
{
"name": "CVE-2022-4046",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
},
{
"name": "CVE-2023-29412",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29412"
},
{
"name": "CVE-2023-27976",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27976"
},
{
"name": "CVE-2022-34755",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34755"
},
{
"name": "CVE-2023-25620",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25620"
},
{
"name": "CVE-2023-1548",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1548"
},
{
"name": "CVE-2023-29411",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29411"
},
{
"name": "CVE-2023-28355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
},
{
"name": "CVE-2023-25619",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25619"
},
{
"name": "CVE-2022-45788",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45788"
},
{
"name": "CVE-2022-4224",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4224"
},
{
"name": "CVE-2021-29241",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29241"
},
{
"name": "CVE-2020-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0297",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-011-06 du 11 janvier 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-011-06_CODESYSV3_Runtime_Development_System_and_Gateway_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-05 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-05.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-06 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-06.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-04 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-02 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-02.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-03 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-03.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-01 du 11 avril 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-05 du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-313-05 du 09 novembre 2021",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_BadAlloc_Vulnerabilities_Security_Notification.pdf"
}
]
}
CERTFR-2023-AVI-0218
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | IGSS Dashboard versions antérieures à 16.0.0.23041 | ||
| Schneider Electric | N/A | Schneider Electric EcoStruxure Power Monitoring Expert version antérieures à 2022 CU1 | ||
| Schneider Electric | N/A | Schneider Electric PowerLogic HDPM6000 versions antérieures à 0.58.7 | ||
| Schneider Electric | N/A | IGSS Custom Reports versions antérieures à 16.0.0.23041 | ||
| Schneider Electric | N/A | IGSS Data Server versions antérieures à 16.0.0.23041 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IGSS Dashboard versions ant\u00e9rieures \u00e0 16.0.0.23041",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric EcoStruxure Power Monitoring Expert version ant\u00e9rieures \u00e0 2022 CU1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric PowerLogic HDPM6000 versions ant\u00e9rieures \u00e0 0.58.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Custom Reports versions ant\u00e9rieures \u00e0 16.0.0.23041",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Data Server versions ant\u00e9rieures \u00e0 16.0.0.23041",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-27983",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27983"
},
{
"name": "CVE-2023-28003",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28003"
},
{
"name": "CVE-2023-27982",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27982"
},
{
"name": "CVE-2023-27981",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27981"
},
{
"name": "CVE-2023-27979",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27979"
},
{
"name": "CVE-2023-27980",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27980"
},
{
"name": "CVE-2023-28004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28004"
},
{
"name": "CVE-2023-27984",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27984"
},
{
"name": "CVE-2023-27977",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27977"
},
{
"name": "CVE-2023-27978",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27978"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0218",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-073-02 du 14 mars 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-073-02.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-073-04 du 14 mars 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-073-04.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-073-01 du 14 mars 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-073-01.pdf"
}
]
}
CERTFR-2023-AVI-0126
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Merten Jalousie-/Schaltaktor REG-K/8x/16x/10 m. HB version du programme 1.0 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | Merten INSTABUS Tastermodul 1fach System M version du programme 1.0 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | EcoStruxure TM Geo SCADA Expert 2021 sans le dernier correctif de sécurité d'octobre 2022 | ||
| Schneider Electric | N/A | StruxureWare DataCenter Expert versions antérieures à V7.9.3 | ||
| Schneider Electric | N/A | Merten KNX ARGUS 180/2,20M UP SYSTEM version du programme 1.0 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | Merten INSTABUS Tastermodul 2fach System M version du programme 1.0 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | EcoStruxure TM Geo SCADA Expert 2019 sans le dernier correctif de sécurité d'octobre 2022 | ||
| Schneider Electric | N/A | Merten KNX Uni-Dimmaktor LL REG-K/2x230/300 W version du programme 1.0 et 1.1 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | Merten KNX Schaltakt.2x6A UP m.2 Eing. version du programme 0.1 si une taille de la clé BCU est inférieure à 8 chiffres | ||
| Schneider Electric | N/A | EcoStruxure TM Geo SCADA Expert 2020 sans le dernier correctif de sécurité d'octobre 2022 | ||
| Schneider Electric | N/A | Merten Tasterschnittstelle 4fach plus version du programme 1.0 et 1.2 si une taille de la clé BCU est inférieure à 8 chiffres |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Merten Jalousie-/Schaltaktor REG-K/8x/16x/10 m. HB version du programme 1.0 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten INSTABUS Tastermodul 1fach System M version du programme 1.0 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure TM Geo SCADA Expert 2021 sans le dernier correctif de s\u00e9curit\u00e9 d\u0027octobre 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "StruxureWare DataCenter Expert versions ant\u00e9rieures \u00e0 V7.9.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten KNX ARGUS 180/2,20M UP SYSTEM version du programme 1.0 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten INSTABUS Tastermodul 2fach System M version du programme 1.0 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure TM Geo SCADA Expert 2019 sans le dernier correctif de s\u00e9curit\u00e9 d\u0027octobre 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten KNX Uni-Dimmaktor LL REG-K/2x230/300 W version du programme 1.0 et 1.1 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten KNX Schaltakt.2x6A UP m.2 Eing. version du programme 0.1 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure TM Geo SCADA Expert 2020 sans le dernier correctif de s\u00e9curit\u00e9 d\u0027octobre 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Merten Tasterschnittstelle 4fach plus version du programme 1.0 et 1.2 si une taille de la cl\u00e9 BCU est inf\u00e9rieure \u00e0 8 chiffres",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-25554",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25554"
},
{
"name": "CVE-2023-25553",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25553"
},
{
"name": "CVE-2023-25547",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25547"
},
{
"name": "CVE-2023-25551",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25551"
},
{
"name": "CVE-2023-25556",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25556"
},
{
"name": "CVE-2023-0595",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0595"
},
{
"name": "CVE-2023-25555",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25555"
},
{
"name": "CVE-2023-25552",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25552"
},
{
"name": "CVE-2023-25550",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25550"
},
{
"name": "CVE-2023-25549",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25549"
},
{
"name": "CVE-2023-25548",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25548"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider\u00a0Electric SEVD-2023-045-01 du 14 f\u00e9vrier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-01.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider\u00a0Electric SEVD-2023-045-02 du 14 f\u00e9vrier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-02.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider\u00a0Electric SEVD-2023-045-03 du 14 f\u00e9vrier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-045-03.pdf"
}
],
"reference": "CERTFR-2023-AVI-0126",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un contournement\nde la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-045-03 du 14 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-045-01 du 14 f\u00e9vrier 2023",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-045-02 du 14 f\u00e9vrier 2023",
"url": null
}
]
}
CERTFR-2023-AVI-0014
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure Power SCADA Anywhere versions 2022, 2021, 2020 R2, 2020, 9.0 et 8.x | ||
| Schneider Electric | N/A | EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020 et EcoStruxure Geo SCADA Expert 2021 (anciennement ClearSCADA) sans le correctif de sécurité d'octobre 2022 | ||
| Schneider Electric | N/A | EcoStruxure Power SCADA Operation 2020 R2 versions 2020 R2 and 2020 R2 CU1, 2020 R2 CU2 et 2020 R2 CU3 sans la dernière version du microgiciel | ||
| Schneider Electric | N/A | EcoStruxure Process Expert versions antérieures à V2021 | ||
| Schneider Electric | N/A | SoMachine - HVAC V2.1.0 et antérieures (Schneider Electric recommande de migrer vers Ecostruxure Machine Expert – HVAC version V1.5.0) | ||
| Schneider Electric | N/A | Ecostruxure Machine Expert – HVAC versions antérieures à V1.5.0 | ||
| Schneider Electric | N/A | Power SCADA Operation 9.0 et PowerSCADA Expert 8.x | ||
| Schneider Electric | N/A | EcoStruxure Power Operation 2021 versions 2021, 2021 CU1, 2021 CU2 et 2021 CU3 sans la dernière version du microgiciel | ||
| Schneider Electric | N/A | EcoStruxure Power SCADA Operation 2020 versions 2020 and 2020 CU1 sans la dernière version du microgiciel |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure Power SCADA Anywhere versions 2022, 2021, 2020 R2, 2020, 9.0 et 8.x",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020 et EcoStruxure Geo SCADA Expert 2021 (anciennement ClearSCADA) sans le correctif de s\u00e9curit\u00e9 d\u0027octobre 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power SCADA Operation 2020 R2 versions 2020 R2 and 2020 R2 CU1, 2020 R2 CU2 et 2020 R2 CU3 sans la derni\u00e8re version du microgiciel",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 V2021",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SoMachine - HVAC V2.1.0 et ant\u00e9rieures (Schneider Electric recommande de migrer vers Ecostruxure Machine Expert \u2013 HVAC version V1.5.0)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Ecostruxure Machine Expert \u2013 HVAC versions ant\u00e9rieures \u00e0 V1.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Power SCADA Operation 9.0 et PowerSCADA Expert 8.x",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Operation 2021 versions 2021, 2021 CU1, 2021 CU2 et 2021 CU3 sans la derni\u00e8re version du microgiciel",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power SCADA Operation 2020 versions 2020 and 2020 CU1 sans la derni\u00e8re version du microgiciel",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-38138",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38138"
},
{
"name": "CVE-2022-2988",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2988"
},
{
"name": "CVE-2023-22610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22610"
},
{
"name": "CVE-2023-22611",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22611"
},
{
"name": "CVE-2022-1467",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1467"
},
{
"name": "CVE-2022-45789",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45789"
},
{
"name": "CVE-2022-45788",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45788"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-03_EcoStruxure_Power_Operation_Power_SCADA_Operation_Security_Notification.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-01_EcoStruxure_Machine_Expert_Machine_HVAC_Security_Notification.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-04_EcoStruxure_Power_SCADA_Anywhere_Security_Notification.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf"
}
],
"reference": "CERTFR-2023-AVI-0014",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric du 10 janvier 2023",
"url": null
}
]
}
CERTFR-2022-AVI-896
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure Power Operation 2021 versions antérieures à CU3 | ||
| Schneider Electric | N/A | Pro-face BLUE versions antérieures à V3.3 Service Pack 1 | ||
| Schneider Electric | N/A | EcoStruxure Power SCADA Operation 2020 R2 versions antérieures à CU1 | ||
| Schneider Electric | N/A | SAGE RTU C3413, C3412 CPU (ces versions sont obsolètes, il est préférable de migrer vers la version C3414-500-S02K5_P5 de SAGE RTU C3414 CPU) | ||
| Schneider Electric | N/A | EcoStruxure Panel Server Box (PAS900) versions antérieures à 3.1.18 | ||
| Schneider Electric | N/A | EcoStruxure Operator Terminal Expert versions antérieures à V3.3 Service Pack 1 | ||
| Schneider Electric | N/A | SAGE RTU C3414 CPU versions antérieures à C3414-500-S02K5_P5 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure Power Operation 2021 versions ant\u00e9rieures \u00e0 CU3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Pro-face BLUE versions ant\u00e9rieures \u00e0 V3.3 Service Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power SCADA Operation 2020 R2 versions ant\u00e9rieures \u00e0 CU1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SAGE RTU C3413, C3412 CPU (ces versions sont obsol\u00e8tes, il est pr\u00e9f\u00e9rable de migrer vers la version C3414-500-S02K5_P5 de SAGE RTU C3414 CPU)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Panel Server Box (PAS900) versions ant\u00e9rieures \u00e0 3.1.18",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Operator Terminal Expert versions ant\u00e9rieures \u00e0 V3.3 Service Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SAGE RTU C3414 CPU versions ant\u00e9rieures \u00e0 C3414-500-S02K5_P5",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41666",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41666"
},
{
"name": "CVE-2022-41671",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41671"
},
{
"name": "CVE-2022-41667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41667"
},
{
"name": "CVE-2022-30552",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30552"
},
{
"name": "CVE-2022-30790",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30790"
},
{
"name": "CVE-2022-2463",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2463"
},
{
"name": "CVE-2022-2464",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2464"
},
{
"name": "CVE-2022-41670",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41670"
},
{
"name": "CVE-2022-41668",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41668"
},
{
"name": "CVE-2022-22727",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22727"
},
{
"name": "CVE-2022-41669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41669"
},
{
"name": "CVE-2022-2465",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2465"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-896",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-11T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des versions correctives",
"revision_date": "2022-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-284-01 du 11 octobre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-284-01_EcoStruxure_Operator_Terminal_Expert_and_Pro-face_BLUE_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-284-04 du 11 octobre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-284-04-EcoStruxure_Power_Operation_and_EcoStruxure_Power_SCADA.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-284-03 du 11 octobre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-284-03-SAGE_RTU_ISaGraf_Workbench_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-284-02 du 11 octobre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-284-02-EcoStruxure_Panel_Server_Box_PAS900_Security_Notification.pdf"
}
]
}
CERTFR-2022-AVI-815
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| N/A | N/A | Modicon MC80 sans le correctif de sécurité BMKC8020301 | ||
| N/A | N/A | CANopen X80 Communication Module (BMECXM0100) toutes versions | ||
| Schneider Electric | N/A | Modicon MC80 (BMKC80) versions antérieures à 1.8 | ||
| Schneider Electric | N/A | Modicon MC80 Controller (BMKC8*) versions antérieures à 1.8 | ||
| Schneider Electric | Modicon M340 | Modicon M340 X80 Ethernet Communication Modules BMXNOE0110 (H) toutes versions | ||
| Schneider Electric | Modicon M340 | Modicon M340 X80 Ethernet Communication Modules BMXNOE0100 (H) toutes versions | ||
| N/A | N/A | EcoStruxure™ Control Expert version 15.1 sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | Modicon RTU BMXNOR0200H versions antérieures à 1.7 IR24 | ||
| Schneider Electric | Modicon M340 | Modicon M340 X80 Ethernet Communication Module BMXNOR0200H RTU versions antérieures à 1.7 IR24 | ||
| Schneider Electric | Modicon M340 | Modicon M340 Ethernet TCP/IP Network Module BMXNOC0401 versions antérieures à 2.11 | ||
| Schneider Electric | N/A | Profibus Remote Master (TCSEGPA23F14F) toutes versions | ||
| Schneider Electric | N/A | Lexium ILE ILA ILS Communication Drive versions antérieures à 01.110 | ||
| Schneider Electric | Modicon M340 | Modicon M340 X80 Ethernet Communication module BMXNOC0401 versions antérieures à version 2.11 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon MC80 sans le correctif de s\u00e9curit\u00e9 BMKC8020301",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "CANopen X80 Communication Module (BMECXM0100) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon MC80 (BMKC80) versions ant\u00e9rieures \u00e0 1.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon MC80 Controller (BMKC8*) versions ant\u00e9rieures \u00e0 1.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 X80 Ethernet Communication Modules BMXNOE0110 (H) toutes versions",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 X80 Ethernet Communication Modules BMXNOE0100 (H) toutes versions",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure\u2122 Control Expert version 15.1 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon RTU BMXNOR0200H versions ant\u00e9rieures \u00e0 1.7 IR24",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 X80 Ethernet Communication Module BMXNOR0200H RTU versions ant\u00e9rieures \u00e0 1.7 IR24",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 Ethernet TCP/IP Network Module BMXNOC0401 versions ant\u00e9rieures \u00e0 2.11",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Profibus Remote Master (TCSEGPA23F14F) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Lexium ILE ILA ILS Communication Drive versions ant\u00e9rieures \u00e0 01.110",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 X80 Ethernet Communication module BMXNOC0401 versions ant\u00e9rieures \u00e0 version 2.11",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-7564",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7564"
},
{
"name": "CVE-2020-7563",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7563"
},
{
"name": "CVE-2020-7535",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7535"
},
{
"name": "CVE-2020-35198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
},
{
"name": "CVE-2020-7549",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7549"
},
{
"name": "CVE-2021-31401",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31401"
},
{
"name": "CVE-2022-37301",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37301"
},
{
"name": "CVE-2018-7241",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7241"
},
{
"name": "CVE-2022-0222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0222"
},
{
"name": "CVE-2018-7242",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7242"
},
{
"name": "CVE-2021-31400",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31400"
},
{
"name": "CVE-2021-22788",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22788"
},
{
"name": "CVE-2020-35685",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35685"
},
{
"name": "CVE-2020-7562",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7562"
},
{
"name": "CVE-2020-35683",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35683"
},
{
"name": "CVE-2020-35684",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35684"
},
{
"name": "CVE-2020-7536",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7536"
},
{
"name": "CVE-2018-7857",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7857"
},
{
"name": "CVE-2019-6807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6807"
},
{
"name": "CVE-2018-7240",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7240"
},
{
"name": "CVE-2011-4859",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4859"
},
{
"name": "CVE-2020-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
},
{
"name": "CVE-2021-22787",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22787"
},
{
"name": "CVE-2021-22785",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22785"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V11.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-257-02 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-257-02_Web_Server_Modicon_M340_Quantum_and_Premium_and_Communication_Modules_V2.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2018-081-01 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-081-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2018-081-01_Embedded_FTP_Servers_for_Modicon_PAC_Controllers_Security_Notification_V4.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-06 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-06_Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-07 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-07\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-07_SNMP_Service_Modicon_M340_CPU_Security_Notification_V2.1.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-217-01 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-217-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-217-01_NicheStack_Security_Notification_V3.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-134-11 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-134-11\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2019-134-11_Modicon_Controllers_Security_Notification_V7.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-02 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-02_Modicon_Controllers_Security_Notification_V2.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SESB-2019-214-01 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2019-214-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SESB-2019-214-01_Wind_River_VxWorks_Security_Bulletin_V2.14.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-315-01 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-315-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-315-01_Modicon_Web_Server_Security_Notification_V3.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-05 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-05-Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.1.pdf"
}
],
"reference": "CERTFR-2022-AVI-815",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire, un d\u00e9ni de service et une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-256-01 du 13 septembre 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-256-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-256-01-EcoStruxure_Machine_SCADA_ExpertPro-face_BLUE_Open_Studio_Security_Notification.pdf"
}
]
}
CERTFR-2022-AVI-717
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| N/A | N/A | Eurotherm Data Reviewer3.0.2 software versions antérieures 4.0.0 | ||
| N/A | N/A | Modicon Momentum MDI (171CBU*) toutes versions | ||
| Schneider Electric | N/A | EcoStruxure Control Expert versions antérieures à 15.2 | ||
| Symfony | process | EcoStruxure Process Expert versions antérieures à 2021 | ||
| N/A | N/A | Modicon M580 CPU (BMEP* et BMEH*) versions antérieures à 4.01 | ||
| Schneider Electric | N/A | Legacy Modicon Quantum toutes versions | ||
| N/A | N/A | OPC UA Modicon Communication Module (BMENUA0100) versions antérieures à 2.01 | ||
| Schneider Electric | N/A | Modicon MC80 (BMKC80) toutes versions | ||
| Schneider Electric | Modicon M340 | Modicon M340 CPU (BMXP34*) versions antérieures 3.50 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Eurotherm Data Reviewer3.0.2 software versions ant\u00e9rieures 4.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon Momentum MDI (171CBU*) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 15.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 2021",
"product": {
"name": "process",
"vendor": {
"name": "Symfony",
"scada": false
}
}
},
{
"description": "Modicon M580 CPU (BMEP* et BMEH*) versions ant\u00e9rieures \u00e0 4.01",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Legacy Modicon Quantum toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "OPC UA Modicon Communication Module (BMENUA0100) versions ant\u00e9rieures \u00e0 2.01",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon MC80 (BMKC80) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 CPU (BMXP34*) versions ant\u00e9rieures 3.50",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-6846",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6846"
},
{
"name": "CVE-2022-34760",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34760"
},
{
"name": "CVE-2020-35198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
},
{
"name": "CVE-2021-22791",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22791"
},
{
"name": "CVE-2022-34762",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34762"
},
{
"name": "CVE-2019-6841",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6841"
},
{
"name": "CVE-2021-45105",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
},
{
"name": "CVE-2021-22779",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22779"
},
{
"name": "CVE-2021-22781",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22781"
},
{
"name": "CVE-2021-22780",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22780"
},
{
"name": "CVE-2021-4104",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
},
{
"name": "CVE-2021-22790",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22790"
},
{
"name": "CVE-2022-37302",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37302"
},
{
"name": "CVE-2022-34761",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34761"
},
{
"name": "CVE-2022-34759",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34759"
},
{
"name": "CVE-2022-37301",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37301"
},
{
"name": "CVE-2018-7241",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7241"
},
{
"name": "CVE-2021-22786",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22786"
},
{
"name": "CVE-2018-7242",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7242"
},
{
"name": "CVE-2019-6844",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6844"
},
{
"name": "CVE-2019-6842",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6842"
},
{
"name": "CVE-2021-22782",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22782"
},
{
"name": "CVE-2021-22778",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22778"
},
{
"name": "CVE-2022-34764",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34764"
},
{
"name": "CVE-2022-34763",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34763"
},
{
"name": "CVE-2021-45046",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
},
{
"name": "CVE-2022-37300",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37300"
},
{
"name": "CVE-2021-22789",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22789"
},
{
"name": "CVE-2019-6847",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6847"
},
{
"name": "CVE-2022-34765",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34765"
},
{
"name": "CVE-2021-44228",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"name": "CVE-2021-22792",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22792"
},
{
"name": "CVE-2019-6843",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6843"
},
{
"name": "CVE-2018-7240",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7240"
},
{
"name": "CVE-2011-4859",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-4859"
},
{
"name": "CVE-2020-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
},
{
"name": "CVE-2021-44832",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
},
{
"name": "CVE-2020-12525",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12525"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-717",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-08-09T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des liens",
"revision_date": "2022-08-22T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des liens des bulletins de s\u00e9curit\u00e9 Schneider SEVD-2022-221-01, SEVD-2022-221-02 et SEVD-2022-221-04 du 9 ao\u00fbt 2022.",
"revision_date": "2022-09-08T00:00:00.000000"
},
{
"description": "Ajout du libell\u00e9 [SCADA] dans le titre.",
"revision_date": "2022-09-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SESB-2021-347-01 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SESB-2021-347-01_Apache_Log4j_Log4Shell_Vulnerabilities_Security_Notification_V14.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-281-02 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-281-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2019-281-02_Modicon_Controllers_Security_Notification_V3.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-01 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-01_EcoStruxure_Control_Expert_Modicon580_Security_Notification_V1.1.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-193-01 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules_Security_Notification_V3.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V10.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-03 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-03_EcoStruxure_Control_Expert_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-02 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-02_Modicon_Controllers_Security_Notification_V1.1.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2018-081-01 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-081-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2018-081-01_Embedded_FTP_Servers_for_Modicon_PAC_Controllers_Security_Notification_V3.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-222-04 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-222-04_Modicon_PAC_Controllers_PLC_Simulator_Control_Expert_Process_Expert_Security_Notification_V2.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-194-01 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-194-01_EcoStruxure_Control_Expert_Process_Expert_SCADAPack_RemoteConnect_Modicon_M580_M340_Security_Notifcation_V4.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-04 du 9 ao\u00fbt 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-04-Modicon_Controllers_Ethernet_Modules_Security_Notification_V1.1.pdf"
}
]
}
CERTFR-2022-AVI-646
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | EcoStruxure Control Expert (incluant le produit Unity Pro) versions antérieures à 15.1 HF001 | ||
| Schneider Electric | N/A | X80 advanced RTU Communication Module (BMENOR2200H) versions antérieures à 2.0.1 | ||
| Schneider Electric | N/A | OPC UA Modicon Communication Module (BMENUA0100) versions 1.10 et antérieures : L'éditeur ne propose pas de correctif, se référer aux mesures de contournement | ||
| Schneider Electric | N/A | EcoStruxure Process Expert (incluant le produit HDCS) versions antérieures à 2021 | ||
| Schneider Electric | N/A | SCADAPack RemoteConnect pour x70 versions antérieures à R2.7.3 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EcoStruxure Control Expert (incluant le produit Unity Pro) versions ant\u00e9rieures \u00e0 15.1 HF001",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "X80 advanced RTU Communication Module (BMENOR2200H) versions ant\u00e9rieures \u00e0 2.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "OPC UA Modicon Communication Module (BMENUA0100) versions 1.10 et ant\u00e9rieures : L\u0027\u00e9diteur ne propose pas de correctif, se r\u00e9f\u00e9rer aux mesures de contournement",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Process Expert (incluant le produit HDCS) versions ant\u00e9rieures \u00e0 2021",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack RemoteConnect pour x70 versions ant\u00e9rieures \u00e0 R2.7.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-21814",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21814"
},
{
"name": "CVE-2022-34760",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34760"
},
{
"name": "CVE-2021-21830",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21830"
},
{
"name": "CVE-2021-22797",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22797"
},
{
"name": "CVE-2022-34762",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34762"
},
{
"name": "CVE-2021-21828",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21828"
},
{
"name": "CVE-2021-21810",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21810"
},
{
"name": "CVE-2021-21813",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21813"
},
{
"name": "CVE-2022-34761",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34761"
},
{
"name": "CVE-2021-21825",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21825"
},
{
"name": "CVE-2022-34759",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34759"
},
{
"name": "CVE-2021-21829",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21829"
},
{
"name": "CVE-2022-34764",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34764"
},
{
"name": "CVE-2022-34763",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34763"
},
{
"name": "CVE-2021-21826",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21826"
},
{
"name": "CVE-2021-21812",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21812"
},
{
"name": "CVE-2021-21827",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21827"
},
{
"name": "CVE-2022-26507",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26507"
},
{
"name": "CVE-2022-34765",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34765"
},
{
"name": "CVE-2021-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21815"
},
{
"name": "CVE-2021-21811",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21811"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric\u00a0SEVD-2022-193-01 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules_Security_Notification_V3.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric\u00a0SEVD-2021-257-01 mis \u00e0 jour le 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-257-01_EcoStruxure_Control_Expert_EcoStruxure_Process_Expert_SCADAPack_Security_Notification_V3.0.pdf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric\u00a0SEVD-2021-222-02 mis \u00e0 jour le 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-222-02_AT%26T_Labs-XMILX_DEMILL_Eco_Struxure_Control_ExpertEco_Struxure_Process_Expert_SCADA_Pack_RemoteConnect_x70_Security_Notification_V4.0.pdf"
}
],
"reference": "CERTFR-2022-AVI-646",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-15T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour du lien du bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-01 du 12 juillet 2022.",
"revision_date": "2022-08-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-02 mis \u00e0 jour le 12 juillet 2022",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-01 du 12 juillet 2022",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-257-01 mis \u00e0 jour le 12 juillet 2022",
"url": null
}
]
}
CERTFR-2022-AVI-628
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | SpaceLogic C-Bus Home Controller (5200WHC2), C-Bus Wiser Homer Controller MK2 versions antérieures à 4.14.0 (PICED_V4.14.0 Programming Interface for C-Bus Embedded Devices version V4.14.0) | ||
| Schneider Electric | N/A | X80 advanced RTU Communication Module (BMENOR2200H) versions antérieures à 2.01 | ||
| Schneider Electric | N/A | IGSS Data Server versions antérieures à 15.0.0.22074 | ||
| Schneider Electric | N/A | SCADAPack RemoteConnect for x70 versions antérieures à R2.7.3 | ||
| Schneider Electric | N/A | Micrologiciels Easergy P5 versions antérieures à 01.401.102 | ||
| Schneider Electric | N/A | Acti9 PowerTag Link C (A9XELC10-B) versions antérieures à 2.14.0 | ||
| Schneider Electric | N/A | OPC UA Modicon Communication Module (BMENUA0100) versions 1.10 et antérieures | ||
| Schneider Electric | N/A | Acti9 PowerTag Link C (A9XELC10-A) versions antérieures à 2.14.0 | ||
| Schneider Electric | N/A | EcoStruxure Machine Expert versions antérieures à 2.0.3 | ||
| Schneider Electric | N/A | Micrologiciels Smart-UPS SCL, SRT, SRC, & XU Series versions antérieures à 15.0 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SpaceLogic C-Bus Home Controller (5200WHC2), C-Bus Wiser Homer Controller MK2 versions ant\u00e9rieures \u00e0 4.14.0 (PICED_V4.14.0 Programming Interface for C-Bus Embedded Devices version V4.14.0)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "X80 advanced RTU Communication Module (BMENOR2200H) versions ant\u00e9rieures \u00e0 2.01",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Data Server versions ant\u00e9rieures \u00e0 15.0.0.22074",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack RemoteConnect for x70 versions ant\u00e9rieures \u00e0 R2.7.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Micrologiciels Easergy P5 versions ant\u00e9rieures \u00e0 01.401.102",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Acti9 PowerTag Link C (A9XELC10-B) versions ant\u00e9rieures \u00e0 2.14.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "OPC UA Modicon Communication Module (BMENUA0100) versions 1.10 et ant\u00e9rieures",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Acti9 PowerTag Link C (A9XELC10-A) versions ant\u00e9rieures \u00e0 2.14.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Machine Expert versions ant\u00e9rieures \u00e0 2.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Micrologiciels Smart-UPS SCL, SRT, SRC, \u0026 XU Series versions ant\u00e9rieures \u00e0 15.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-2329",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2329"
},
{
"name": "CVE-2021-21814",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21814"
},
{
"name": "CVE-2021-21869",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21869"
},
{
"name": "CVE-2022-34760",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34760"
},
{
"name": "CVE-2021-21830",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21830"
},
{
"name": "CVE-2021-21866",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21866"
},
{
"name": "CVE-2021-22797",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22797"
},
{
"name": "CVE-2022-34753",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34753"
},
{
"name": "CVE-2022-34762",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34762"
},
{
"name": "CVE-2022-34758",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34758"
},
{
"name": "CVE-2021-22779",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22779"
},
{
"name": "CVE-2021-22781",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22781"
},
{
"name": "CVE-2021-22780",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22780"
},
{
"name": "CVE-2021-21828",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21828"
},
{
"name": "CVE-2021-21810",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21810"
},
{
"name": "CVE-2021-21813",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21813"
},
{
"name": "CVE-2022-34761",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34761"
},
{
"name": "CVE-2022-22806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22806"
},
{
"name": "CVE-2021-21825",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21825"
},
{
"name": "CVE-2022-34759",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34759"
},
{
"name": "CVE-2022-34757",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34757"
},
{
"name": "CVE-2021-21829",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21829"
},
{
"name": "CVE-2021-21863",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21863"
},
{
"name": "CVE-2022-34754",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34754"
},
{
"name": "CVE-2021-22782",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22782"
},
{
"name": "CVE-2021-22778",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22778"
},
{
"name": "CVE-2022-34764",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34764"
},
{
"name": "CVE-2022-0715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0715"
},
{
"name": "CVE-2021-21865",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21865"
},
{
"name": "CVE-2022-34763",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34763"
},
{
"name": "CVE-2021-21867",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21867"
},
{
"name": "CVE-2022-34756",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34756"
},
{
"name": "CVE-2021-21826",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21826"
},
{
"name": "CVE-2021-21812",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21812"
},
{
"name": "CVE-2021-21827",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21827"
},
{
"name": "CVE-2022-22805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22805"
},
{
"name": "CVE-2022-26507",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26507"
},
{
"name": "CVE-2021-29241",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29241"
},
{
"name": "CVE-2022-34765",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34765"
},
{
"name": "CVE-2021-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21815"
},
{
"name": "CVE-2021-21811",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21811"
},
{
"name": "CVE-2020-12525",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12525"
},
{
"name": "CVE-2021-29240",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29240"
},
{
"name": "CVE-2021-21864",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21864"
},
{
"name": "CVE-2022-24324",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24324"
},
{
"name": "CVE-2021-21868",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21868"
},
{
"name": "CVE-2021-33485",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33485"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-628",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-12T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des liens",
"revision_date": "2022-08-22T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des liens",
"revision_date": "2022-08-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-194-01 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-194-01_EcoStruxure_Control_Expert_Process_Expert_SCADAPack_RemoteConnect_Modicon_M580_M340_V4.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-02 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-01 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules_Security_Notification_V3.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-03 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-03_Acti9_PowerTag_Link_C_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-011-06 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-011-06_CODESYSV3_Runtime_Development_System_and_Gateway_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-257-01 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-257-01_EcoStruxure_Control_Expert_EcoStruxure_Process_Expert_SCADAPack_Security_Notification_V3.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-067-02 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-067-02_APC-Smart-UPS_Security_Notification_V6.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-102-01 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-193-04 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-222-02 du 12 juillet 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-222-02_AT%26T_Labs-XMILX_DEMILL_Eco_Struxure_Control_ExpertEco_Struxure_Process_Expert_SCADA_Pack_RemoteConnect_x70_Security_Notification_V4.0.pdf"
}
]
}
CERTFR-2022-AVI-546
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Schneider Electric C-Bus Network Automation Controller LSS5500SHAC versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | Clipsal C-Bus Network Automation Controller 5500SHAC versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | Conext ComBox toutes versions | ||
| Schneider Electric | N/A | SpaceLogic C-Bus Network Automation Controller 5500NAC2 versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | CanBRASS versions antérieures à 7.6 | ||
| Schneider Electric | N/A | StruxureWare Data Center Expert versions antérieures à 7.9.1 | ||
| N/A | N/A | EcoStruxure Power Commission versions antérieures à 2.22 | ||
| Schneider Electric | N/A | Smart-UPS SMT SMC, SMX, SRC, XU, XP, SURTD, CHS2 et SRTL Series toutes versions | ||
| Schneider Electric | N/A | EcoStruxure Cybersecurity Admin Expert (CAE) versions antérieures à 2.4 | ||
| Schneider Electric | N/A | IGSS Data Server versions antérieures à 15.0.0.22170 | ||
| Schneider Electric | N/A | Geo SCADA Mobile versions antérieures au Build 202205171 | ||
| Schneider Electric | N/A | Smart-UPS SRT Series versions antérieures à 15.0 | ||
| Schneider Electric | N/A | Schneider Electric C-Bus Network Automation Controller LSS5500NAC versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | EcoStruxure Power Build: Rapsody Software versions antérieures à 2.1.13 | ||
| Schneider Electric | N/A | EPC2000 versions antérieures à 4.03 | ||
| Schneider Electric | N/A | Versadac versions antérieures à 2.43 | ||
| Schneider Electric | N/A | Clipsal C-Bus Network Automation Controller 5500NAC versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | SCADAPack RemoteConnect pour x70 versions antérieures à R2.7.3 | ||
| Schneider Electric | N/A | SpaceLogic C-Bus Network Automation Controller 5500AC2 versions antérieures à 1.11.0 | ||
| Schneider Electric | N/A | Smart-UPS SCL Series versions antérieures à 15.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Schneider Electric C-Bus Network Automation Controller LSS5500SHAC versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Clipsal C-Bus Network Automation Controller 5500SHAC versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Conext ComBox toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SpaceLogic C-Bus Network Automation Controller 5500NAC2 versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "CanBRASS versions ant\u00e9rieures \u00e0 7.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "StruxureWare Data Center Expert versions ant\u00e9rieures \u00e0 7.9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Commission versions ant\u00e9rieures \u00e0 2.22",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Smart-UPS SMT SMC, SMX, SRC, XU, XP, SURTD, CHS2 et SRTL Series toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Cybersecurity Admin Expert (CAE) versions ant\u00e9rieures \u00e0 2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Data Server versions ant\u00e9rieures \u00e0 15.0.0.22170",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Geo SCADA Mobile versions ant\u00e9rieures au Build 202205171",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Smart-UPS SRT Series versions ant\u00e9rieures \u00e0 15.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric C-Bus Network Automation Controller LSS5500NAC versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EcoStruxure Power Build: Rapsody Software versions ant\u00e9rieures \u00e0 2.1.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EPC2000 versions ant\u00e9rieures \u00e0 4.03",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Versadac versions ant\u00e9rieures \u00e0 2.43",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Clipsal C-Bus Network Automation Controller 5500NAC versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack RemoteConnect pour x70 versions ant\u00e9rieures \u00e0 R2.7.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SpaceLogic C-Bus Network Automation Controller 5500AC2 versions ant\u00e9rieures \u00e0 1.11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Smart-UPS SCL Series versions ant\u00e9rieures \u00e0 15.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-32524",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32524"
},
{
"name": "CVE-2022-24322",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24322"
},
{
"name": "CVE-2022-22731",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22731"
},
{
"name": "CVE-2022-32514",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32514"
},
{
"name": "CVE-2020-35198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
},
{
"name": "CVE-2022-32517",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32517"
},
{
"name": "CVE-2022-32526",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32526"
},
{
"name": "CVE-2022-32530",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32530"
},
{
"name": "CVE-2022-32748",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32748"
},
{
"name": "CVE-2022-22806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22806"
},
{
"name": "CVE-2022-32529",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32529"
},
{
"name": "CVE-2022-32513",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32513"
},
{
"name": "CVE-2022-32747",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32747"
},
{
"name": "CVE-2022-32523",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32523"
},
{
"name": "CVE-2022-32528",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32528"
},
{
"name": "CVE-2022-32516",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32516"
},
{
"name": "CVE-2022-32522",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32522"
},
{
"name": "CVE-2022-32527",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32527"
},
{
"name": "CVE-2022-32515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32515"
},
{
"name": "CVE-2021-22697",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22697"
},
{
"name": "CVE-2022-0715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0715"
},
{
"name": "CVE-2022-0223",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0223"
},
{
"name": "CVE-2022-32519",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32519"
},
{
"name": "CVE-2022-22805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22805"
},
{
"name": "CVE-2022-24323",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24323"
},
{
"name": "CVE-2022-32512",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32512"
},
{
"name": "CVE-2022-32518",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32518"
},
{
"name": "CVE-2022-22732",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22732"
},
{
"name": "CVE-2020-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
},
{
"name": "CVE-2022-32520",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32520"
},
{
"name": "CVE-2022-32525",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32525"
},
{
"name": "CVE-2021-22698",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22698"
},
{
"name": "CVE-2022-32521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32521"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-546",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
},
{
"description": "Modification de la version des produits IGSS Data Server",
"revision_date": "2022-06-23T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour du lien du bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-02 du 08 mars 2022.",
"revision_date": "2022-08-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-02 du 08 mars 2022",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-067-02_APC-Smart-UPS_Security_Notification_V6.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-07 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-07_CanBRASS_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-06 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-06_C-Bus_Home_Automation_Products_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-01 du 08 mars 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-067-01_EcoStruxure_Control_Expert_and_EcoStruxure_Process_Expert_Security_Notification_V2.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-02 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-02_Geo_SCADA_Android_App_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-08 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-012-02 du 12 janvier 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-012-02_EcoStruxure_Power_Build_Rapsody_Security_Notification_V2.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-04 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-04_%20StruxureWare_Data_Center_Expert_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-01 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-05 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 09 novembre 2021",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V8.0.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-03 du 14 juin 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf"
}
]
}
CERTFR-2022-AVI-328
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon M262 Logic Controllers versions antérieures à V5.1.6.1 | ||
| Schneider Electric | N/A | MiCOM C264 versions antérieures à B5.118, D1.92, D4.38, D5.25I et D6.18 | ||
| Schneider Electric | N/A | PowerLogic ION7400 versions antérieures à 3.1.0 | ||
| Schneider Electric | N/A | EPC2000 toutes versions | ||
| Schneider Electric | N/A | EPack toutes versions | ||
| N/A | N/A | Easy Harmony GXU (gamme HMIGXU) Vijeo Designer Basic versions antérieures à 1.2.1 | ||
| Schneider Electric | N/A | nanodac versions antérieures à 10.02 | ||
| N/A | N/A | Versadac toutes versions | ||
| Schneider Electric | N/A | BMXNOR0200H RTU toutes versions | ||
| Schneider Electric | N/A | EPC3000 versions antérieures à V5.20 | ||
| Schneider Electric | N/A | Modicon M241/M251 Logic Controllers versions antérieures à V5.1.9.34 | ||
| Schneider Electric | N/A | SAGE RTU CPU C3414 version antérieures à C3414-500-S02K5_P5 de SAGE RTU CPU3414 | ||
| Schneider Electric | N/A | BMXNOE0100 (H) toutes versions | ||
| N/A | N/A | JACE-8000 versions antérieures à Niagara 4.10u1 | ||
| Schneider Electric | N/A | BMENOC0321, BMENOC0301, BMENOC0311, BMENOS0300 toutes versions | ||
| Schneider Electric | N/A | 6100A, 6180A, 6100XIO, 6180XIO, AeroDAQ toutes versions | ||
| Schneider Electric | N/A | Eurotherm E+PLC100 toutes versions | ||
| N/A | N/A | SCD6000 Industrial RTU versions antérieures à SY-1101207, et N de SCD6000 | ||
| Schneider Electric | N/A | Pro-face SP-5B00, SP-5B10, SP-5B90, gamme ST6000 (modèle GP-ProEX), gamme ET6000 versions antérieures à V4.09.350 | ||
| Schneider Electric | N/A | Momentum MDI (171CBU*), MC80 (BMKC8*), HART (BMEAH*),V1.50 toutes versions | ||
| N/A | N/A | BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, 140CRA31908 toutes versions | ||
| Schneider Electric | N/A | BMXNOE0100, BMXNOE0110, BMXNGD0100, BMXNOC0401 toutes versions | ||
| Schneider Electric | N/A | Easergy MiCOM P40 toutes versions | ||
| N/A | N/A | Modicon M258/LMC058 Logic Controllers versions antérieures à 5.0.4.18 | ||
| Schneider Electric | N/A | Modicon Quantum CPU et Communication Modules toutes versions | ||
| N/A | N/A | Modicon Premium CPU et Communication Modules toutes versions | ||
| N/A | N/A | Easergy MiCOM P30 versions 660 à 674 | ||
| Schneider Electric | N/A | PowerLogic ION9000 versions antérieures à 3.1.0 | ||
| Schneider Electric | N/A | Easergy C5x (C52/C53) versions antérieures à 1.0.5 | ||
| Schneider Electric | N/A | gammes HMISTO et HMISTU/S5T toutes versions | ||
| Schneider Electric | N/A | PacDrive Eco/Pro/Pro2 Logic Controllers versions antérieures à V1.66.5.1 | ||
| Schneider Electric | N/A | Easergy P5 versions antérieures à 01.401.101 | ||
| Schneider Electric | N/A | CPU Modicon M580 (BMEP* et BMEH*), BMXNOM0200 toutes versions | ||
| N/A | N/A | BMXNOE0110 (H) toutes versions | ||
| Schneider Electric | N/A | Gammes Pro-face GP4000, LT4000M et GP4000H toutes versions | ||
| Schneider Electric | N/A | TCSEGPA23F14F, BMECXM0100 toutes versions | ||
| N/A | N/A | HMISCU Vijeo Designer versions V6.2SP11 et antérieures | ||
| N/A | N/A | PowerLogic PM8000 versions antérieures à 3.1.0 | ||
| N/A | N/A | PacDrive M toutes versions | ||
| N/A | N/A | Easy Harmony ET6 (gamme HMIET) Vijeo Designer Basic versions antérieures à 1.2.1 | ||
| N/A | N/A | Momentum ENT (170ENT11*) toutes versions | ||
| N/A | N/A | Gammes Pro-face GP4100, GP4000E et GP4000M toutes versions | ||
| Schneider Electric | N/A | BMXNOM0200 toutes versions | ||
| N/A | N/A | IGSS Data Server versions antérieures à 15.0.0.22074 | ||
| N/A | N/A | BMENOP0300, BMXNOR0200 toutes versions | ||
| Schneider Electric | N/A | Modicon LMC078 toutes versions | ||
| Schneider Electric | N/A | Harmony/ Magelis, gammes HMIGTU, HMIGTUX et HMIGK versions antérieures à 6.2 SP11 Multi HotFix 4 | ||
| Schneider Electric | Modicon M340 | Modicon M340 versions antérieures à 3.50 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon M262 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "MiCOM C264 versions ant\u00e9rieures \u00e0 B5.118, D1.92, D4.38, D5.25I et D6.18",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PowerLogic ION7400 versions ant\u00e9rieures \u00e0 3.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EPC2000 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EPack toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easy Harmony GXU (gamme HMIGXU) Vijeo Designer Basic versions ant\u00e9rieures \u00e0 1.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "nanodac versions ant\u00e9rieures \u00e0 10.02",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Versadac toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "BMXNOR0200H RTU toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EPC3000 versions ant\u00e9rieures \u00e0 V5.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M241/M251 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.9.34",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SAGE RTU CPU C3414 version ant\u00e9rieures \u00e0 C3414-500-S02K5_P5 de SAGE RTU CPU3414",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMXNOE0100 (H) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "JACE-8000 versions ant\u00e9rieures \u00e0 Niagara 4.10u1",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "BMENOC0321, BMENOC0301, BMENOC0311, BMENOS0300 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "6100A, 6180A, 6100XIO, 6180XIO, AeroDAQ toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Eurotherm E+PLC100 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCD6000 Industrial RTU versions ant\u00e9rieures \u00e0 SY-1101207, et N de SCD6000",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Pro-face SP-5B00, SP-5B10, SP-5B90, gamme ST6000 (mod\u00e8le GP-ProEX), gamme ET6000 versions ant\u00e9rieures \u00e0 V4.09.350",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Momentum MDI (171CBU*), MC80 (BMKC8*), HART (BMEAH*),V1.50 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, 140CRA31908 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "BMXNOE0100, BMXNOE0110, BMXNGD0100, BMXNOC0401 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easergy MiCOM P40 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M258/LMC058 Logic Controllers versions ant\u00e9rieures \u00e0 5.0.4.18",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon Quantum CPU et Communication Modules toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Premium CPU et Communication Modules toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Easergy MiCOM P30 versions 660 \u00e0 674",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "PowerLogic ION9000 versions ant\u00e9rieures \u00e0 3.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easergy C5x (C52/C53) versions ant\u00e9rieures \u00e0 1.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "gammes HMISTO et HMISTU/S5T toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Eco/Pro/Pro2 Logic Controllers versions ant\u00e9rieures \u00e0 V1.66.5.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Easergy P5 versions ant\u00e9rieures \u00e0 01.401.101",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "CPU Modicon M580 (BMEP* et BMEH*), BMXNOM0200 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMXNOE0110 (H) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Gammes Pro-face GP4000, LT4000M et GP4000H toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "TCSEGPA23F14F, BMECXM0100 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "HMISCU Vijeo Designer versions V6.2SP11 et ant\u00e9rieures",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "PowerLogic PM8000 versions ant\u00e9rieures \u00e0 3.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "PacDrive M toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Easy Harmony ET6 (gamme HMIET) Vijeo Designer Basic versions ant\u00e9rieures \u00e0 1.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Momentum ENT (170ENT11*) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Gammes Pro-face GP4100, GP4000E et GP4000M toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "BMXNOM0200 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "IGSS Data Server versions ant\u00e9rieures \u00e0 15.0.0.22074",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "BMENOP0300, BMXNOR0200 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Modicon LMC078 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Harmony/ Magelis, gammes HMIGTU, HMIGTUX et HMIGK versions ant\u00e9rieures \u00e0 6.2 SP11 Multi HotFix 4",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 versions ant\u00e9rieures \u00e0 3.50",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-35198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
},
{
"name": "CVE-2021-22156",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22156"
},
{
"name": "CVE-2022-0222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0222"
},
{
"name": "CVE-2020-28895",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
},
{
"name": "CVE-2022-24324",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24324"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-328",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-102-02 du 12 avril 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-102-02_Modicon_M340_Controller_and_Communication_Modules_Security_Notification.pdf\u0026p_Doc_Ref=SEVD-2022-102-02"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-102-01 du 12 avril 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification.pdf\u0026p_Doc_Ref=SEVD-2022-102-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 09 novembre 2021 mis \u00e0 jour le 12 avril 2022",
"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V6.0.pdf\u0026p_Doc_Ref=SEVD-2021-313-05"
}
]
}