EcoStruxure Control Expert V15.1+ Remote Code Exec via Web Endpoint (CWE-668)
CVE-2023-27976 Published on April 18, 2023

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert (V15.1 and above)

NVD

Vulnerability Analysis

CVE-2023-27976 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.


Products Associated with CVE-2023-27976

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-27976 are published in Schneider Electric Ecostruxure Control Expert:

Schneider Electric Ecostruxure Control Expert
 

Affected Versions

Schneider Electric EcoStruxure Control Expert Version V15.1 and above is affected by CVE-2023-27976

Exploit Probability

EPSS
0.61%
Percentile
69.25%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.