CVE-2022-37302 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Ecostruxure Control Expert

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources

Severity

5.5MEDIUMNVD

EPSS

0.1%

top 67.72%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Schneider-electric Ecostruxure Control Expert Schneider Electric Ecostruxure Control Expert

Timeline

PublishedSep 13

Latest updateSep 14

Description

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software when an incorrect project file is opened. Affected Products: EcoStruxure Control Expert(V15.1 HF001 and prior).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDschneider-electric/ecostruxure_control_expert< 15.1+1

▶CVEListV5schneider_electric/ecostruxure_control_expertHF001 — 15.1

Patches

Patch: www.se.com ↗Patch: www.se.com ↗

🔴Vulnerability Details

GHSA

GHSA-mp38-wwj7-h8qj: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert↗2022-09-14

▶

CVEList

CVE-2022-37302: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert↗2022-09-13

▶