High severity · published Jan 31, 2023
CVE-2023-22610
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of
Service against the Geo SCADA server when specific messages are sent to the server over the
database server TCP port.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EG
Ecostruxure Geo Scada Expert 2019 · Schneider-electric
81.7268.1; 81.7322.1; 81.7429.2; 81.7457.1; 81.7488.1; 81.7522.1; +22 more · source: NVD
EG
Ecostruxure Geo Scada Expert 2020 · Schneider-electric
83.7551.1; 83.7578.1; 83.7613.1; 83.7641.1; 83.7692.1; 83.7717.1; +16 more · source: NVD
EG
Ecostruxure Geo Scada Expert 2021 · Schneider-electric
84.8027.1; 84.8108.1; 84.8120.1; 84.8158.1; 84.8182.1; 84.8197.1; +2 more · source: NVD
Affected product
EG
Ecostruxure Geo Scada Expert 2019
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22610
Mitigation
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-02_Geo_SCADA_Security_Notification.pdf
More from Ecostruxure Geo Scada Expert 2019
7.8
CVE-2020-28219
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1…
7.5
CVE-2023-22611
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server…
7.5
CVE-2022-24321
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed…
7.5
CVE-2022-24318
A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used
6.7
CVE-2021-22741
Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure…