CVE-2023-2569 — Schneider Electric / EcoStruxure Foxboro DCS Control Core Services

Description (CNA)

A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure Foxboro DCS Control Core Services	affected All versions prior to patch HF9857795

CWE

CWE-787

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf

CISA-ADP

No English description supplied.

No references supplied.