A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated
attacker to gain the same privilege as the application on the server when a malicious payload is
provided over HTTP for the server to execute.
References
| Link | Resource |
|---|---|
| https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-02.pdf | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
28 Apr 2023, 01:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-02.pdf - Patch, Vendor Advisory | |
| CPE | cpe:2.3:o:schneider-electric:conext_gateway_firmware:1.16:-:*:*:*:*:*:* cpe:2.3:o:schneider-electric:conext_gateway_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insightfacility_firmware:1.16:-:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insighthome_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:conext_gateway:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:insighthome:-:*:*:*:*:*:*:* cpe:2.3:o:schneider-electric:conext_gateway_firmware:1.16:build_004:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insighthome_firmware:1.16:build_004:*:*:*:*:*:* cpe:2.3:h:schneider-electric:insightfacility:-:*:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insightfacility_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insightfacility_firmware:1.16:build_004:*:*:*:*:*:* cpe:2.3:o:schneider-electric:insighthome_firmware:1.16:-:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Schneider-electric conext Gateway Firmware
Schneider-electric insighthome Firmware Schneider-electric Schneider-electric insightfacility Schneider-electric conext Gateway Schneider-electric insightfacility Firmware Schneider-electric insighthome |
18 Apr 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-18 22:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-29410
Mitre link : CVE-2023-29410
CVE.ORG link : CVE-2023-29410
JSON object : View
Products Affected
schneider-electric
- insightfacility_firmware
- conext_gateway_firmware
- insighthome_firmware
- conext_gateway
- insighthome
- insightfacility
CWE
CWE-20
Improper Input Validation