Vulnerability · Published Apr 18, 2023 · Assigned by schneider
CVE-2023-28003
Medium 6.7
In plain English
A medium-severity security flaw in EcoStruxure Power Monitoring Expert from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.3%top 75.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert | All – through PME 2022 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H