6.8med
CVE-2017-8371
Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attacker…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
0
none known
Summary
Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitive information via unspecified vectors.
Exploit prediction (EPSS)
1.00% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
- CWE-522 Insufficiently Protected Credentials
References
- download.schneider-electric.com /files?p_Doc_Ref=SEVD-2016-343-01 · x_refsource_MISC, x_transferred
- datacenterdynamics.com /content-tracks/security-risk/schneider-patches-critical-vulnerability-in-struxureware-dci · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-8371
- NVD: CVE-2017-8371
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.