Vulnerability · Published Nov 15, 2023 · Assigned by schneider
CVE-2023-6032
Medium 5.3
In plain English
A medium-severity path traversal in Galaxy VL from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 52.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Galaxy VS | v6.82 |
| Schneider Electric | Galaxy VL | v12.21 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N