Schneider Electric NetBotz 4 - 355/450/455/550/570
At a glance
- Source
- NVD
- EPSS
- EPSS 0.46 % · percentile 40 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Modified
Description
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted. Affected Products: NetBotz 4 - 355/450/455/550/570Â (V4.7.0 and prior)
Weaknesses (CWE)
- CWE-1021 — Improper Restriction of Rendered UI Layers or Frames
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | schneider |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | NVD · cybersecurity@se.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-46417
- GCVE · GCVE-0-2022-43378
CERT-FR advisories
- CERTFR-2022-AVI-1000 — Multiples vulnérabilités dans les produits Schneider · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:schneider-electric:netbotz_355_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.7.0cpe:2.3:o:schneider-electric:netbotz_450_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.7.0cpe:2.3:o:schneider-electric:netbotz_455_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.7.0cpe:2.3:o:schneider-electric:netbotz_550_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.7.0cpe:2.3:o:schneider-electric:netbotz_570_firmware:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.7.0
Affected products
| Product | Versions |
|---|---|
| Schneider Electric · NetBotz 4 - 355/450/455/550/570 | affected V4.7.0 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |