Vulnerability · Published Feb 24, 2023 · Assigned by schneider

CVE-2023-0595

Medium 5.3

In plain English

A medium-severity security flaw in ClearSCADA from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)

Affected products (as reported)

Vendor	Product	Versions
Schneider Electric	EcoStruxure Geo SCADA Expert 2019	All – through October 2022
Schneider Electric	EcoStruxure Geo SCADA Expert 2020	All – through October 2022
Schneider Electric	EcoStruxure Geo SCADA Expert 2021	All – through October 2022
Schneider Electric	ClearSCADA	All Versions

Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-045-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-045-01.pdf