CVE-2022-32748 — Schneider Electric / EcoStruxure™ Cybersecurity Admin Expert (CAE)

Description (CNA)

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure™ Cybersecurity Admin Expert (CAE)	affected All before 2.2

CWE

CWE-295

References

https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf

CISA-ADP

No English description supplied.

No references supplied.