ZDI-CAN-21035: ZDI-23-1795: Schneider Electric EcoStruxure Power Monitoring Expert GetFilteredSinkProvider Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published Dec 15, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2023-5391.

Affected Software

1 affected component

Schneider Electric EcoStruxure Power Monitoring Expert

Event History

Dec 15, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-21035?

The vulnerability ZDI-CAN-21035 has a CVSS rating of 9.8, indicating a critical severity level.

What is the impact of ZDI-CAN-21035?

ZDI-CAN-21035 allows remote attackers to execute arbitrary code without authentication on affected installations.

Which software is affected by ZDI-CAN-21035?

ZDI-CAN-21035 affects Schneider Electric EcoStruxure Power Monitoring Expert.

How do I fix ZDI-CAN-21035?

To remediate ZDI-CAN-21035, update to the latest version of Schneider Electric EcoStruxure Power Monitoring Expert as per the vendor's guidance.

Is authentication required to exploit ZDI-CAN-21035?

No, authentication is not required to exploit the ZDI-CAN-21035 vulnerability.