Vulnerability-Lookup

CNVD-2026-22248

Vulnerability from cnvd - Published: 2026-05-29

Title

Schneider Electric Ecostruxure Machine Expert HVAC敏感信息明文存储漏洞

Description

Schneider Electric Ecostruxure Machine Expert HVAC是法国施耐德电气（Schneider Electric）公司的一个面向暖通空调设备控制与自动化工程的软件平台。 Schneider Electric Ecostruxure Machine Expert HVAC存在敏感信息明文存储漏洞，攻击者可利用该漏洞在授权访问源代码时泄露受保护源代码并丧失机密性。

Severity

高

Patch Name

Schneider Electric Ecostruxure Machine Expert HVAC敏感信息明文存储漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.se.com/ww/en/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-6332

Impacted products

Name
Schneider Electric ecostruxure machine expert hvac <1.10.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-6332",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-6332"
    }
  },
  "description": "Schneider Electric Ecostruxure Machine Expert HVAC\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u9762\u5411\u6696\u901a\u7a7a\u8c03\u8bbe\u5907\u63a7\u5236\u4e0e\u81ea\u52a8\u5316\u5de5\u7a0b\u7684\u8f6f\u4ef6\u5e73\u53f0\u3002\n\nSchneider Electric Ecostruxure Machine Expert HVAC\u5b58\u5728\u654f\u611f\u4fe1\u606f\u660e\u6587\u5b58\u50a8\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u6388\u6743\u8bbf\u95ee\u6e90\u4ee3\u7801\u65f6\u6cc4\u9732\u53d7\u4fdd\u62a4\u6e90\u4ee3\u7801\u5e76\u4e27\u5931\u673a\u5bc6\u6027\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.se.com/ww/en/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-22248",
  "openTime": "2026-05-29",
  "patchDescription": "Schneider Electric Ecostruxure Machine Expert HVAC\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u9762\u5411\u6696\u901a\u7a7a\u8c03\u8bbe\u5907\u63a7\u5236\u4e0e\u81ea\u52a8\u5316\u5de5\u7a0b\u7684\u8f6f\u4ef6\u5e73\u53f0\u3002\r\n\r\nSchneider Electric Ecostruxure Machine Expert HVAC\u5b58\u5728\u654f\u611f\u4fe1\u606f\u660e\u6587\u5b58\u50a8\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u6388\u6743\u8bbf\u95ee\u6e90\u4ee3\u7801\u65f6\u6cc4\u9732\u53d7\u4fdd\u62a4\u6e90\u4ee3\u7801\u5e76\u4e27\u5931\u673a\u5bc6\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric Ecostruxure Machine Expert HVAC\u654f\u611f\u4fe1\u606f\u660e\u6587\u5b58\u50a8\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Schneider Electric ecostruxure machine expert hvac \u003c1.10.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-6332",
  "serverity": "\u9ad8",
  "submitTime": "2026-05-20",
  "title": "Schneider Electric Ecostruxure Machine Expert HVAC\u654f\u611f\u4fe1\u606f\u660e\u6587\u5b58\u50a8\u6f0f\u6d1e"
}

CVE-2026-6332 (GCVE-0-2026-6332)

Vulnerability from cvelistv5 – Published: 2026-05-14 16:54 – Updated: 2026-05-14 18:37

Title

Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC

Summary

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-312 - Cleartext storage of sensitive information

Assigner

schneider

References

1 reference

URL	Tags
https://download.schneider-electric.com/files?p_D…

Impacted products

1 product

Vendor	Product	Version
Schneider Electric	Ecostruxure™ Machine Expert HVAC	Affected: Versions prior to 1.10.0

Date Public

2026-05-12 16:49

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6332",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T18:37:08.735767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T18:37:23.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ecostruxure\u2122 Machine Expert HVAC",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions prior to 1.10.0"
            }
          ]
        }
      ],
      "datePublic": "2026-05-12T16:49:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it."
            }
          ],
          "value": "CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext storage of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T16:54:50.465Z",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-132-01.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Clear Text Storage of Sensitive Information on EcoStruxure\u2122 Machine Expert HVAC",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2026-6332",
    "datePublished": "2026-05-14T16:54:50.465Z",
    "dateReserved": "2026-04-15T07:55:30.087Z",
    "dateUpdated": "2026-05-14T18:37:23.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2026-22248

CVE-2026-6332 (GCVE-0-2026-6332)

Tags

Sightings

Nomenclature