Schneider Electric Data Center Expert 7.4.0 password recoverable

Summaryinfo

A vulnerability classified as problematic has been found in Schneider Electric Data Center Expert. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in password recoverable. This vulnerability was named CVE-2022-32519. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Schneider Electric Data Center Expert (SCADA Software). It has been classified as problematic. This affects some unknown processing. The manipulation with an unknown input leads to a password recoverable vulnerability. CWE is classifying the issue as CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. This is going to have an impact on confidentiality. The summary by CVE is:

A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0)

The weakness was presented 01/31/2023 as SEVD-2022-165-04. The advisory is shared at download.schneider-electric.com. This vulnerability is uniquely identified as CVE-2022-32519 since 06/07/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 7.9.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-35590). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• SCADA Software

Vendor

• Schneider Electric

Name

• Data Center Expert

Version

• 7.4.0

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion