CVE-2022-24319

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

Score

CVSS 3.1 5.9 Medium

Status

Modified - cybersecurity@se.com

Published

2022-02-09

Last modified

2024-08-03

Weaknesses

CWE-295

Affected products

• Clearscada (Schneider-electric)
• Ecostruxure Geo Scada Expert 2019 (Schneider-electric)
• Ecostruxure Geo Scada Expert 2020 (Schneider-electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0018/MNDT-2022-0018.md