Schneider Electric vulnerabilities
433 CVEs and advisories name Schneider Electric as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-8422CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & inte
- CVE-2024-8306CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and ava
- CVE-2024-6918CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutec
- CVE-2024-6407CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to th
- CVE-2024-6528CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnera
- CVE-2024-2602CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code
- CVE-2024-5681CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerne
- CVE-2024-5680CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local
- CVE-2024-5679CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor wit
- CVE-2024-0865CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrati
- CVE-2024-5559CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an atta
- CVE-2024-2747CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user re
- CVE-2024-37040CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to
- CVE-2024-37039CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra
- CVE-2024-37038CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface
- CVE-2024-37037CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate
- CVE-2024-37036CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa
- CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a s
- CVE-2024-5557CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacke
- CVE-2024-5558CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker a
- CVE-2024-5313CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface.
- CVE-2024-5056CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and p
- CVE-2024-2229 CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loa
- CVE-2024-2052 CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltrat
- CVE-2024-2050 CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects
- CVE-2024-2051 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized
- CVE-2024-0568 CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communicatio
- CVE-2023-27975 CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure
- CVE-2023-6408 CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a d
- CVE-2023-6409 CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with applicati