CVE-2023-27976 Other in EcoStruxure Control Expert

What is CVE-2023-27976?

CVE-2023-27976 is a high-severity vulnerability in Schneider Electric EcoStruxure Control Expert, published on 18 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert (V15.1 and above)

Weakness: CWE-668

Which versions are affected by CVE-2023-27976?

It affects 1 product.

Products include Schneider-Electric Ecostruxure Control Expert.

How do I fix CVE-2023-27976?

No fix has been published for CVE-2023-27976 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27976 being exploited?

There is no known exploitation of CVE-2023-27976 in the wild and no public exploit code.

Other vulnerabilities in Schneider Electric EcoStruxure Control Expert

• CVE-2022-37300 Auth bypass in EcoStruxure Control Expert Critical 9.8
• CVE-2020-28212 Auth bypass in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) Critical 9.8
• CVE-2020-7475 Code injection in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10) Critical 9.8
• CVE-2020-28213 Code injection in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) High 8.8
• CVE-2020-7560 Memory corruption in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions) High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p5fw-f837-j4p4.