CVE-2023-25549: Code Injection
Published Apr 18, 2023
·Updated
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint.
Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
Affected Software
1 affected component
Schneider-electric Struxureware Data Center Expert<=7.9.2
Event History
Apr 18, 2023
CVE Published
via MITRE·08:35 PM
Data Sourced
via MITRE·08:35 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-25549.
2
What is the severity of CVE-2023-25549?
The severity of CVE-2023-25549 is critical with a severity value of 9.8.
3
What is the CWE ID of CVE-2023-25549?
The CWE ID of CVE-2023-25549 is CWE-94.
4
Which product is affected by CVE-2023-25549?
The affected product is StruxureWare Data Center Expert (V7.9.2 and prior) by Schneider-electric.
5
How can the CVE-2023-25549 vulnerability be exploited?
The CVE-2023-25549 vulnerability can be exploited by using a parameter of the DCE network settings endpoint to execute remote code.