Vulnerability Details CVE-2023-25554
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS
Command Injection') vulnerability exists that allows a local privilege escalation on the appliance
when a maliciously crafted Operating System command is entered on the device.
Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 34.3%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2023-25554
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.3.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.2
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.4.3
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.5.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.6.0
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.7.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.8.1
-
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:7.9.2