Vulnerability · Published Mar 9, 2022 · Assigned by schneider
CVE-2022-24323
Medium 5.3
In plain English
A medium-severity security flaw in EcoStruxure Control Expert from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Process Expert | V2021 and prior |
| Schneider Electric | EcoStruxure Control Expert | V15.0 SP1 and prior |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H