Vulnerabilites related to schneider-electric - vijeo_designer
cve-2024-8306
Vulnerability from cvelistv5
Published
2024-09-11 15:05
Modified
2024-09-11 18:21
Severity ?
EPSS score ?
Summary
CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized
access, loss of confidentiality, integrity and availability of the workstation when non-admin
authenticated user tries to perform privilege escalation by tampering with the binaries.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Schneider Electric | Vijeo Designer |
Version: Prior to V6.3 SP1 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vijeo_designer",
"vendor": "schneider-electric",
"versions": [
{
"lessThan": "6.3 SP1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-11T18:16:24.377142Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T18:21:20.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vijeo Designer",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Prior to V6.3 SP1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All Versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized\naccess, loss of confidentiality, integrity and availability of the workstation when non-admin\nauthenticated user tries to perform privilege escalation by tampering with the binaries."
}
],
"value": "CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized\naccess, loss of confidentiality, integrity and availability of the workstation when non-admin\nauthenticated user tries to perform privilege escalation by tampering with the binaries."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:05:31.560Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-254-01.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-8306",
"datePublished": "2024-09-11T15:05:31.560Z",
"dateReserved": "2024-08-29T09:01:34.777Z",
"dateUpdated": "2024-09-11T18:21:20.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-22705
Vulnerability from cvelistv5
Published
2021-05-26 19:19
Modified
2024-08-03 18:51
Severity ?
EPSS score ?
Summary
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert
References
| ▼ | URL | Tags |
|---|---|---|
| https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0) |
Version: Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-26T19:19:18",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2021-22705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0)",
"version": {
"version_data": [
{
"version_value": "Harmony HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ) or EcoStruxure Machine Expert (all versions prior to V2.0)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02",
"refsource": "MISC",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2021-22705",
"datePublished": "2021-05-26T19:19:18",
"dateReserved": "2021-01-06T00:00:00",
"dateUpdated": "2024-08-03T18:51:07.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-7490
Vulnerability from cvelistv5
Published
2020-04-22 18:48
Modified
2024-08-04 09:33
Severity ?
EPSS score ?
Summary
A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.se.com/ww/en/download/document/SEVD-2020-105-03 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) |
Version: Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:33:19.453Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) ",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-22T18:48:47",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2020-7490",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) ",
"version": {
"version_data": [
{
"version_value": "Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-426: Untrusted Search Path"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03",
"refsource": "MISC",
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2020-7490",
"datePublished": "2020-04-22T18:48:47",
"dateReserved": "2020-01-21T00:00:00",
"dateUpdated": "2024-08-04T09:33:19.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-22704
Vulnerability from cvelistv5
Published
2021-09-02 16:53
Modified
2024-08-03 18:51
Severity ?
EPSS score ?
Summary
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
References
| ▼ | URL | Tags |
|---|---|---|
| http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) |
Version: Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-02T16:53:31",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2021-22704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)",
"version": {
"version_data": [
{
"version_value": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01",
"refsource": "MISC",
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2021-22704",
"datePublished": "2021-09-02T16:53:31",
"dateReserved": "2021-01-06T00:00:00",
"dateUpdated": "2024-08-03T18:51:07.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-7501
Vulnerability from cvelistv5
Published
2020-06-16 19:40
Modified
2024-08-04 09:33
Severity ?
EPSS score ?
Summary
A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.se.com/ww/en/download/document/SEVD-2020-133-02/ | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) |
Version: Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:33:19.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-16T19:40:23",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2020-7501",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior)",
"version": {
"version_data": [
{
"version_value": "Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798: Use of Hard-coded Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/",
"refsource": "MISC",
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2020-7501",
"datePublished": "2020-06-16T19:40:23",
"dateReserved": "2020-01-21T00:00:00",
"dateUpdated": "2024-08-04T09:33:19.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-22817
Vulnerability from cvelistv5
Published
2022-02-09 22:05
Modified
2024-08-03 18:51
Severity ?
EPSS score ?
Summary
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)
References
| ▼ | URL | Tags |
|---|---|---|
| https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06 | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1) |
Version: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-09T22:05:12",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2021-22817",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)",
"version": {
"version_data": [
{
"version_value": "Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-276: Incorrect Default Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06",
"refsource": "MISC",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2021-22817",
"datePublished": "2022-02-09T22:05:12",
"dateReserved": "2021-01-06T00:00:00",
"dateUpdated": "2024-08-03T18:51:07.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2020-04-22 19:15
Modified
2024-11-21 05:37
Severity ?
Summary
A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| schneider-electric | vijeo_designer | * | |
| schneider-electric | vijeo_designer | * | |
| schneider-electric | vijeo_designer | 1.1 | |
| schneider-electric | vijeo_designer | 1.1 | |
| schneider-electric | vijeo_designer | 6.9 | |
| schneider-electric | vijeo_designer | 6.9 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*",
"matchCriteriaId": "74EEFAF2-57EB-4DA0-9917-AD45CFF223F7",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:-:*:*:*",
"matchCriteriaId": "BD560E4B-DE63-4DA4-8E1D-5E261269410A",
"versionEndIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:1.1:-:*:*:basic:*:*:*",
"matchCriteriaId": "165A74FC-8710-4C1A-9961-E1064D7465D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:1.1:hotfix_15:*:*:basic:*:*:*",
"matchCriteriaId": "7C091A26-D571-4E24-A4E8-E7EBEAA9899E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.9:-:*:*:-:*:*:*",
"matchCriteriaId": "A688681A-6CC3-4B9B-8808-DC983D7F44F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.9:sp9:*:*:-:*:*:*",
"matchCriteriaId": "2D00383B-4424-46DB-AC35-6093F489D678",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product."
},
{
"lang": "es",
"value": "CWE-426: hay una vulnerabilidad de Ruta de B\u00fasqueda No Confiable en Vijeo Designer Basic (versiones anteriores a la versi\u00f3n V1.1 HotFix 15 y anteriores) y Vijeo Designer (versiones V6.9 SP9 y anteriores), lo que podr\u00eda causar una ejecuci\u00f3n de c\u00f3digo arbitraria en el sistema que ejecuta Vijeo Basic cuando una biblioteca DLL maliciosa es cargada por el producto."
}
],
"id": "CVE-2020-7490",
"lastModified": "2024-11-21T05:37:14.933",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-22T19:15:11.823",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-105-03"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-426"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-426"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-16 20:15
Modified
2024-11-21 05:37
Severity ?
Summary
A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| schneider-electric | vijeo_designer | * | |
| schneider-electric | vijeo_designer | * | |
| schneider-electric | vijeo_designer | 1.1 | |
| schneider-electric | vijeo_designer | 1.1 | |
| schneider-electric | vijeo_designer | 6.9 | |
| schneider-electric | vijeo_designer | 6.9 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*",
"matchCriteriaId": "74EEFAF2-57EB-4DA0-9917-AD45CFF223F7",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:-:*:*:*",
"matchCriteriaId": "BD560E4B-DE63-4DA4-8E1D-5E261269410A",
"versionEndIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:1.1:-:*:*:basic:*:*:*",
"matchCriteriaId": "165A74FC-8710-4C1A-9961-E1064D7465D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:1.1:hotfix_15:*:*:basic:*:*:*",
"matchCriteriaId": "7C091A26-D571-4E24-A4E8-E7EBEAA9899E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.9:-:*:*:-:*:*:*",
"matchCriteriaId": "A688681A-6CC3-4B9B-8808-DC983D7F44F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.9:sp9:*:*:-:*:*:*",
"matchCriteriaId": "2D00383B-4424-46DB-AC35-6093F489D678",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer."
},
{
"lang": "es",
"value": "Una CWE-798: Se presenta una vulnerabilidad de uso de Credenciales Embebidas en Vijeo Designer Basic (versiones V1.1 HotFix 16 y anteriores) y Vijeo Designer (versiones V6.2 SP9 y anteriores), lo que podr\u00eda causar lectura y escritura no autorizadas al descargar y cargar proyectos o firmware en Vijeo Designer Basic y Vijeo Designer"
}
],
"id": "CVE-2020-7501",
"lastModified": "2024-11-21T05:37:16.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-16T20:15:14.957",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-02/"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-02 17:15
Modified
2024-11-21 05:50
Severity ?
Summary
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5F2F861-8F3B-40B0-9CC4-DB9776052C7A",
"versionEndExcluding": "6.2.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gk:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDBAEC72-A63C-464D-8E62-C42959D4A871",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gto:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDF1060-1FF5-41D5-A8ED-129492CC50A4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gtu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FCFA535-319D-4AB7-AB6C-B4BB0739B7F4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gtux:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEA285A2-8EA7-473D-87A5-62E970BD25C3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_sto:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68382B8C-4FB2-49AC-8CAE-2251400BE342",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_stu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB2002BD-8A77-414F-A530-A7D9350143F5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*",
"matchCriteriaId": "B69EE5F8-4732-4019-BEE4-D80CFCD31FF7",
"versionEndExcluding": "1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gxu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED64924A-493F-48DB-B547-0D2FF7C3C9FE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4DB52BF-192B-4167-872E-AAEC81ACAE7F",
"versionEndExcluding": "2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "25030153-0F86-4598-984C-897A7BB33B48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_scu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BE5BC10-3788-4CC2-BEC9-F07350793F3E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP."
},
{
"lang": "es",
"value": "Una CWE-22: Una vulnerabilidad de Limitaci\u00f3n Inapropiada de un Nombre de Ruta a un Directorio Restringido se presenta en los productos Harmony/HMI Configurados por Vijeo Designer (todas las versiones anteriores a V6.2 SP11 ), Vijeo Designer Basic (todas las versiones anteriores a V1.2) o EcoStruxure Machine Expert (todas las versiones anteriores a V2.0) que podr\u00eda causar una denegaci\u00f3n de servicio o un acceso no autorizado a la informaci\u00f3n del sistema cuando se conecta al Harmony HMI a trav\u00e9s de FTP"
}
],
"id": "CVE-2021-22704",
"lastModified": "2024-11-21T05:50:29.773",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-02T17:15:08.060",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "cybersecurity@se.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-02-09 23:15
Modified
2024-11-21 05:50
Severity ?
Summary
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmuhi29d2801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2582FD66-2D18-4115-94FE-B5BA1B36D595",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmuhi29d2801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA5D45C-B770-4071-ADFA-DB38ADA96C77",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmusi29d2801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E526ACB6-406B-4A0B-BD58-8185A43088DB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmusi29d2801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE62F149-DE0A-4F8F-B39F-65FECEF4FFBD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmuci29d2w01_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2E4839B-4C41-49B7-BB75-53DC622E0538",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmuci29d2w01:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D0096E7C-2BEB-4357-A407-684BD020D59E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29d2001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00883CAD-A710-413D-9055-DCE3C432B98E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29d2001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89595632-4A4B-4686-9A74-5085C13FCF5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29d200a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A7799DB1-B3DE-4E42-BE46-D6B373F1E385",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29d200a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "672471F0-3935-404D-9862-AF2176D72F94",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmuhi29d4801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D1772C9E-767A-4976-9891-DED84D60DB2E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmuhi29d4801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "92017240-B8F2-4E6E-9838-C19BC220A8C3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmusi29d4801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "479F08C5-890C-4416-88B0-B445589EB42F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmusi29d4801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "954991E6-659E-44CA-B731-4CF42F21AD7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmuci29d4w01_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "29D66A0C-B08C-46B5-9F30-C996A175777D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmuci29d4w01:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF2176A2-ABAA-49E2-A875-041F5E3A3A22",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29d4001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D55A3AD8-D0D8-4D49-A4DD-6D3F854A0F85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29d4001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6F2A5C42-E12B-4A88-8D5F-EEB840B38E99",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29d400a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AEFCAF14-18AD-48B6-8840-9843D7E7328A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29d400a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "290E3E00-E797-4DAE-9346-DC13E208CF53",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29di00a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56D231A5-B3B3-43CC-9C4C-667A6F193484",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29di00a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC9AC87-E933-4D44-B2E1-5FE60AEC6DD6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmu0i29de00a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C9AB8F3-A641-4B4B-9504-571EA710672E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmu0i29de00a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7765AB62-92A4-4F88-8F93-ECFE24AECC23",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmphi74d2801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8417A1E5-3375-413E-84A9-57491CE48E49",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmphi74d2801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F29DC0-79C2-43BF-9E44-F08B86C9D831",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmpsi74d2801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6717A2A-B048-4CB7-A642-DC61C3295730",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmpsi74d2801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "643C0A54-D99E-42E1-ACBB-7B95AE322231",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74d2001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50ED61BC-2CE6-44BB-8C39-9483FF8B69A8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74d2001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "57E891B1-22C8-42DB-9510-1F87632248D1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74d200a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3FBC6878-E597-4C23-9FAE-5CD1019ABDA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74d200a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3ACD14D6-CC92-48EF-B523-DFA9BCB3DDCC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmphi74d4801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5FEFF4-D217-4B69-AEBB-304CB5CA6EB7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmphi74d4801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A9ADD1CB-254A-4DED-A51D-0CBA6B23BF68",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmpsi74d4801_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0BA3EAD5-8077-41CF-B110-FEBA36437455",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmpsi74d4801:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F3E401F-9571-4481-9804-F6882B4DCF71",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74d4001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB0AABB-4BAF-45F6-AEAE-EEBA40072D6A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74d4001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "31F13028-D385-46F5-8323-CA30408B7D7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74d400a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7C53B71-EC22-45F9-A1B3-EED82F1FD6F8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74d400a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "85C45F5C-FD91-4DD0-8B82-A6A52A58C4EE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74di00a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E359383D-C0FD-4A51-930C-82BBB8F7B992",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74di00a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "21189E4C-E6C0-4286-A2A7-AFA31E295FD2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmp0i74de00a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9BA0F246-D182-405B-9D90-9BAE2A5315C1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmp0i74de00a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5EF285FB-6120-4E16-B79A-C8931448403E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibscea53d1l01_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5623D4A8-90B1-461C-B3E7-CE78BA199192",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibscea53d1l01:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E3FDC585-E5F4-43F6-96CC-DB69E416F33F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmoma5ddf10l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EF5AC277-B40C-45C0-A498-1C14EFBF1311",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmoma5ddf10l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "745784BB-73D2-4B0A-9241-2DC8ABE7384D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmoma5dd1e01_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A67BB5A2-1EBF-4B2B-A327-3600109D4164",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmoma5dd1e01:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7239963-665D-4E41-BA9E-A880C361DA97",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmoma5dd1101_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F9A1E0AA-BC43-45D7-8CB1-DE88780D8DB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmoma5dd1101:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D9CE124C-166D-41B9-85CE-A5E47B4A73D9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmo0a5ddf10a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "000FAA1F-8C71-4CCC-A16C-0B1E05C55EEC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmo0a5ddf10a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C3D9D8ED-A288-4DC4-B590-8AB061F5A275",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmo0a5ddf101_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D551A0F-C6EE-4198-A79C-AF6813F2F976",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmo0a5ddf101:-:*:*:*:*:*:*:*",
"matchCriteriaId": "612DAD38-8DA2-4BA3-ACFC-9573BDB3035F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmo0a5dd1001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "06785DD2-223C-4F47-8463-9DD9CD749F54",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmo0a5dd1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DCEB0016-41C4-474A-A443-51971BD27567",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmiea5dd1e01_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC155BE8-DF80-479E-B9B0-CC65D47449C0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmiea5dd1e01:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E30E38A1-B3B8-4E1C-A41D-674EF10E9744",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmiea5dd110l_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "90BCDAFB-C1B5-4343-8625-107EFDC4DA5D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmiea5dd110l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "88AF3AAC-95B6-4CEA-A937-E7A3F290F794",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmiea5dd1101_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "206BB40B-10F5-4A57-AD6D-8D79ACF5D2F5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmiea5dd1101:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33C933E5-6FCE-4856-9EBD-B5C4C5CA4806",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmiea5dd100a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D84C9FE7-3327-4170-9714-97B92CA86C88",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmiea5dd100a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F090ECDD-274D-4922-9486-6151EFE173BF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibmiea5dd1001_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B610BCAF-F0D1-4C83-920A-DF3DEFE304F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibmiea5dd1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "022F51ED-C33B-4DBC-B323-68DCFC1638BD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibscea53d1l0t_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "62382830-CD90-4E42-8CA7-FC895A4E95D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibscea53d1l0t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E5E2981B-4D81-4EA0-82E6-E43BCE452702",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:hmibscea53d1l0a_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D789B96-481E-4351-A719-3F01F1D39E4E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:hmibscea53d1l0a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14D00D70-E68B-4008-8A4B-FACF0E29B11A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*",
"matchCriteriaId": "0C7EA9D7-EAB7-4ED8-89C8-ACA8AABB39E7",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:-:*:*:*",
"matchCriteriaId": "6B45AFAC-BCEB-4027-87EB-80C1CE5F5B06",
"versionEndExcluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:-:*:*:-:*:*:*",
"matchCriteriaId": "1C612D97-98B3-4E93-ACF2-C3EEC694EC15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp1:*:*:-:*:*:*",
"matchCriteriaId": "292CA268-9AA4-44C6-AFF1-C3D280B0BF59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp10:*:*:-:*:*:*",
"matchCriteriaId": "78007890-ED6C-400A-A6AA-245884E62C08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp11:*:*:-:*:*:*",
"matchCriteriaId": "FCF14319-9F91-4F23-BFC8-5D05FBE40E32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp2:*:*:-:*:*:*",
"matchCriteriaId": "CB08054F-B66A-49B4-80F2-9071C8703EAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp3.1:*:*:-:*:*:*",
"matchCriteriaId": "AA6B3B3C-9F29-4087-B65A-E1FCDF8305FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp5.1:*:*:-:*:*:*",
"matchCriteriaId": "A5EEA860-DE5E-460C-A8A7-D53E3948C135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp6:*:*:-:*:*:*",
"matchCriteriaId": "F6C4D0D1-DCBB-45BA-9BFC-9A182DEC4C73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp7:*:*:-:*:*:*",
"matchCriteriaId": "5FCA2BF3-B51F-4EA8-941F-9D837BEBEEF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp8:*:*:-:*:*:*",
"matchCriteriaId": "A40F1446-6B20-4540-81B7-89156877A6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.2:sp9:*:*:-:*:*:*",
"matchCriteriaId": "4996F6E0-37B5-4820-AA73-7051482C9FAE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)"
},
{
"lang": "es",
"value": "Una CWE-276: Se presenta una vulnerabilidad de Permisos incorrectos por Defecto que podr\u00eda causar un acceso no autorizado al directorio de instalaci\u00f3n base conllevando a una escalada de privilegios local. Producto afectado: Harmony/Magelis iPC Series (todas las versiones), Vijeo Designer (todas las versiones anteriores a V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (todas las versiones anteriores a V1.2.1)"
}
],
"id": "CVE-2021-22817",
"lastModified": "2024-11-21T05:50:43.910",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-09T23:15:14.937",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-26 20:15
Modified
2024-11-21 05:50
Severity ?
Summary
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cybersecurity@se.com | https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5F2F861-8F3B-40B0-9CC4-DB9776052C7A",
"versionEndExcluding": "6.2.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gk:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FDBAEC72-A63C-464D-8E62-C42959D4A871",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gto:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDF1060-1FF5-41D5-A8ED-129492CC50A4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gtu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FCFA535-319D-4AB7-AB6C-B4BB0739B7F4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_gtux:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AEA285A2-8EA7-473D-87A5-62E970BD25C3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_sto:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68382B8C-4FB2-49AC-8CAE-2251400BE342",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_stu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB2002BD-8A77-414F-A530-A7D9350143F5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B4DB52BF-192B-4167-872E-AAEC81ACAE7F",
"versionEndExcluding": "2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:harmony_hmiscu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63E063B8-1179-48D2-A672-177AA1A0FCE1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert"
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de Restricci\u00f3n Inapropiada de Operaciones dentro de los l\u00edmites de un b\u00fafer de la memoria, que podr\u00eda causar una denegaci\u00f3n de servicio o acceso no autorizado a la informaci\u00f3n del sistema interactuando directamente con un controlador instalado por Vijeo Designer o EcoStruxure Machine Expert"
}
],
"id": "CVE-2021-22705",
"lastModified": "2024-11-21T05:50:29.907",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-26T20:15:08.897",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-02"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "cybersecurity@se.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-09-11 15:15
Modified
2024-09-18 19:51
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized
access, loss of confidentiality, integrity and availability of the workstation when non-admin
authenticated user tries to perform privilege escalation by tampering with the binaries.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| schneider-electric | vijeo_designer | * | |
| schneider-electric | vijeo_designer | 6.3 | |
| schneider-electric | vijeo_designer_embedded_in_ecostruxure_machine_expert | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F4501EC7-939C-4E71-A5D3-3F1112D39190",
"versionEndExcluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:6.3:-:*:*:*:*:*:*",
"matchCriteriaId": "204A592B-1B28-43FC-878F-559BDF5A7944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer_embedded_in_ecostruxure_machine_expert:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99EBBD6F-0C97-493A-B708-60DD27733247",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized\naccess, loss of confidentiality, integrity and availability of the workstation when non-admin\nauthenticated user tries to perform privilege escalation by tampering with the binaries."
},
{
"lang": "es",
"value": "CWE-269: Existe una vulnerabilidad de administraci\u00f3n inadecuada de privilegios que podr\u00eda causar acceso no autorizado, p\u00e9rdida de confidencialidad, integridad y disponibilidad de la estaci\u00f3n de trabajo cuando un usuario autenticado que no es administrador intenta realizar una escalada de privilegios alterando los binarios."
}
],
"id": "CVE-2024-8306",
"lastModified": "2024-09-18T19:51:14.850",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-11T15:15:18.827",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-254-01.pdf"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}