Vulnerability Details CVE-2023-25549
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
allows for remote code execution when using a parameter of the DCE network settings
endpoint.
Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.028
EPSS Ranking 85.5%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2023-25549
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.3.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.2
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.3
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.5.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.6.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.7.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.8.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.9.2