Schneider Electric StruxureWare Data Center Expert
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-37199 | v7.9.3 and earlier | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi | HIGH 7.2 | 0.9 % | ||
| CVE-2023-37198 | v7.9.3 and earlier | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi | HIGH 7.2 | 0.9 % | ||
| CVE-2023-37197 | v7.9.3 and earlier | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could | HIGH 8.8 | 0.6 % | ||
| CVE-2023-37196 | v7.9.3 and earlier | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could | HIGH 8.8 | 0.6 % | ||
| CVE-2023-25555 | All – V7.9.2 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a | HIGH 8.1 | 0.8 % | ||
| CVE-2023-25553 | All – V7.9.2 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint throug | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-25551 | All – V7.9.2 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file upload end | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-25550 | All – V7.9.2 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-25549 | All – V7.9.2 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-25554 | All – V7.9.2 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a loca | HIGH 7.8 | 0.6 % | ||
| CVE-2023-25552 | All – V7.9.2 | A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or p | HIGH 8.1 | 0.5 % | ||
| CVE-2023-25548 | All – V7.9.2 | A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being pr | HIGH 8.8 | 0.5 % | ||
| CVE-2023-25547 | All – V7.9.2 | A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker | HIGH 8.8 | 0.9 % | ||
| CVE-2021-22795 | unspecified – < V7.8.1 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause re | CRITICAL 9.8 | 3.1 % | ||
| CVE-2021-22794 | unspecified – < V7.8.1 | A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code ex | CRITICAL 9.8 | 2.2 % |