CVE-2022-2988 — Out-of-bounds Write in Electric Ecostruxure Machine Expert Hvac

CWE-787 — Out-of-bounds Write3 documents3 sources
Severity
7.5HIGHNVD
CNA4.3
EPSS
0.3%
top 44.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider Electric Ecostruxure Machine Expert HvacSchneider Electric Somachine HvacSchneider-electric Ecostruxure Machine Expert Hvac+1 more
Timeline
PublishedJan 30
Latest updateJul 6

Description

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5schneider_electric/somachine_hvacAll — V2.1.0

🔴Vulnerability Details

2
GHSA
GHSA-q443-qgfv-3fpg: A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commis↗2023-07-06
▶
CVEList
CVE-2022-2988: A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commis↗2023-01-30
▶
CVE-2022-2988 — Out-of-bounds Write | cvebase