Filtered by vendor Schneider-electric Subscriptions
Total 765 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-3001 1 Schneider-electric 1 Igss Dashboard 2025-03-05 7.8 High
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.
CVE-2022-34755 1 Schneider-electric 1 Easergy Builder Installer 2025-03-03 6.3 Medium
A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior)
CVE-2023-25548 1 Schneider-electric 1 Struxureware Data Center Expert 2025-03-03 8.8 High
A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured when a hacker is using a low privileged user. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25552 1 Schneider-electric 1 Struxureware Data Center Expert 2025-03-03 8.1 High
A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25549 1 Schneider-electric 1 Struxureware Data Center Expert 2025-03-03 7.2 High
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-4516 1 Schneider-electric 1 Interactive Graphical Scada System 2025-02-27 7.8 High
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content.
CVE-2023-5402 1 Schneider-electric 1 C-bus Toolkit 2025-02-27 9.8 Critical
A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network.
CVE-2023-5399 1 Schneider-electric 1 Spacelogic C-bus Toolkit 2025-02-27 9.8 Critical
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the personal computer running C-Bus when using the File Command.
CVE-2023-5391 1 Schneider-electric 3 Ecostruxure Power Monitoring Expert, Ecostruxure Power Operation With Advanced Reports, Ecostruxure Power Scada Operation With Advanced Reports 2025-02-27 9.8 Critical
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application.
CVE-2023-25551 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-12 6.1 Medium
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25550 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-12 7.2 High
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25554 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-12 7.8 High
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25547 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-12 8.8 High
A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2018-7841 1 Schneider-electric 1 U.motion Builder 2025-02-07 9.8 Critical
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
CVE-2023-25555 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-06 5.6 Medium
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-25553 1 Schneider-electric 1 Struxureware Data Center Expert 2025-02-06 6.1 Medium
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint through the logging capabilities of the webserver. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVE-2023-28003 1 Schneider-electric 1 Ecostruxure Power Monitoring Expert 2025-02-06 6.7 Medium
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.
CVE-2023-29411 2 Microsoft, Schneider-electric 7 Windows 10, Windows 11, Windows Server 2016 and 4 more 2025-02-06 9.8 Critical
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.
CVE-2023-25556 1 Schneider-electric 14 Merten Instabus Tastermodul 1fach System M, Merten Instabus Tastermodul 1fach System M Firmware, Merten Instabus Tastermodul 2fach System M and 11 more 2025-02-06 8.3 High
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
CVE-2023-1548 1 Schneider-electric 1 Ecostruxure Control Expert 2025-02-06 5.5 Medium
A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert (V15.1 and above)