Improper Cert Validation in EcoStruxure Cybersecurity Admin Expert <2.2 (Cred Leak)
CVE-2022-32748 Published on January 30, 2023
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)
Vulnerability Analysis
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2022-32748
Want to know whenever a new CVE is published for Schneider Electric Ecostruxure Cybersecurity Admin Expert? stack.watch will email you.
Affected Versions
Schneider Electric EcoStruxure™ Cybersecurity Admin Expert (CAE):- Version All and below 2.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.