This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Schneider-Electric First view 2020-04-22
Product Ecostruxure Machine Expert Last view 2021-09-02
Version Type Application
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:* 5
cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:2.0:*:*:*:*:*:*:* 1

Related : CVE

  Date Alert Description
9.1 2021-09-02 CVE-2021-22704

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.

7.8 2021-05-26 CVE-2021-22705

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert

9.8 2020-04-22 CVE-2020-7489

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.

7.5 2020-04-22 CVE-2020-7488

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers.

9.8 2020-04-22 CVE-2020-7487

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers.

CWE : Common Weakness Enumeration

%idName
20% (1) CWE-345 Insufficient Verification of Data Authenticity
20% (1) CWE-319 Cleartext Transmission of Sensitive Information
20% (1) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
20% (1) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')
20% (1) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...