CVE-2024-8531
published 2024-10-11CVE-2024-8531: CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is…
PriorityP343high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.45%
36.1th percentile
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
compromise the Data Center Expert software when an upgrade bundle is manipulated to
include arbitrary bash scripts that are executed as root.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider_electric | data_center_expert | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric Data Center Expert
cisa_ics·2025-01-16·CVSS 5.9
[MEDIUM] Schneider Electric Data Center Expert
ICS Advisory
##
Schneider Electric Data Center Expert
Release DateJanuary 16, 2025
Alert CodeICSA-25-016-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Schneider Electric
- Equipment: Data Center Expert
- Vulnerabilities: Improper Verification of Cryptographic Signature, Missing Authentication for Critical Function
## 2. RISK EVALUATION
Exploitation of these vulnerabilities could allow an attacker to expose private data or achieve remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports that the following products are affected:
- Schneider Electric Data C
CISA ICS
Schneider Electric Data Center Expert
cisa_ics·2024-10-15·CVSS 5.9
[MEDIUM] Schneider Electric Data Center Expert
ICS Advisory
##
Schneider Electric Data Center Expert
Release DateOctober 15, 2024
Alert CodeICSA-24-289-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.6
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Schneider Electric
- Equipment: Data Center Expert
- Vulnerability: Improper Verification of Cryptographic Signature, Missing Authentication for Critical Function
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to access private data.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports that the following versions of Data Center Expert, a monitoring software, are affected:
- Dat
GHSA
GHSA-53j3-c5gj-9m5j: CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
compromise the Data Center Expert software when an upgrade b
ghsa_unreviewed·2024-10-11
CVE-2024-8531 [HIGH] CWE-347 GHSA-53j3-c5gj-9m5j: CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
compromise the Data Center Expert software when an upgrade b
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
compromise the Data Center Expert software when an upgrade bundle is manipulated to
include arbitrary bash scripts that are executed as root.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-11
Published