CVE-2023-22611 — HIGH (7.5)

Vulnerability Description

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. Affected Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022)

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Schneider-Electric	Ecostruxure Geo Scada Expert 2019	-
Schneider-Electric	Ecostruxure Geo Scada Expert 2020	-
Schneider-Electric	Ecostruxure Geo Scada Expert 2021	-

Related Weaknesses (CWE)

CWE-200

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocMitigationPatchVendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocMitigationPatchVendor Advisory

FAQ

What is CVE-2023-22611?

CVE-2023-22611 is a vulnerability with a CVSS score of 7.5 (HIGH). A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database serve...

How severe is CVE-2023-22611?

CVE-2023-22611 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-22611?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Ecostruxure Geo Scada Expert 2019, Schneider-Electric Ecostruxure Geo Scada Expert 2020, Schneider-Electric Ecostruxure Geo Scada Expert 2021.