ZDI-23-1795: Schneider Electric EcoStruxure Power Monitoring Expert GetFilteredSinkProvider Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published Dec 15, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2023-5391.

Affected Software

1 affected component

Schneider Electric EcoStruxure Power Monitoring Expert

Event History

Dec 15, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-23-1795?

The severity of ZDI-23-1795 is rated 9.8 on the CVSS scale, indicating a critical vulnerability.

How do I fix ZDI-23-1795?

To fix ZDI-23-1795, update to the latest version of Schneider Electric EcoStruxure Power Monitoring Expert that addresses this vulnerability.

Who is affected by ZDI-23-1795?

All installations of Schneider Electric EcoStruxure Power Monitoring Expert are affected by ZDI-23-1795.

Does ZDI-23-1795 require authentication to exploit?

No, ZDI-23-1795 does not require authentication to be exploited by remote attackers.

What type of vulnerability is ZDI-23-1795?

ZDI-23-1795 is a remote code execution vulnerability.