CVE-2023-22611

EUVD-2023-26747 · Published Jan 31, 2023

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. Affected Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022)

Technologies

Schneider-Electric Ecostruxure Geo Scada Expert 2021Schneider-Electric Ecostruxure Geo Scada Expert 2020Schneider-Electric Ecostruxure Geo Scada Expert 2019

Weaknesses

CWE-200

CVSS scores

v3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf

Potentially impacted assets

See if this affects your attack surface