CVE-2023-22610 Missing authorization in EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)
Attackers can cause denial of service against the Geo SCADA server by sending specific messages to the database server TCP port due to incorrect authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22610?
CVE-2023-22610 is a critical missing authorization vulnerability in Schneider Electric EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA), published on 31 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port.
Weakness: CWE-863
Which versions are affected by CVE-2023-22610?
It affects 3 products.
Products include Schneider-Electric Ecostruxure Geo Scada Expert 2019, Schneider-Electric Ecostruxure Geo Scada Expert 2020, Schneider-Electric Ecostruxure Geo Scada Expert 2021.
How do I fix CVE-2023-22610?
No fix has been published for CVE-2023-22610 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-22610 being exploited?
There is no known exploitation of CVE-2023-22610 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)
- CVE-2020-28219 Information disclosure in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1)
- CVE-2023-22611 Information disclosure in EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)
Sources
Also known as GHSA-xxmc-mjxm-2m5r.