CVE-2022-24319 - A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted

Back Back to CVE browser

MEDIUM

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted

Published Feb 9, 2022

5.9

MEDIUM

CVSS 3.1

EPSS 0.57%

Description

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05
x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29217
Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0018/MNDT-2022-0018.md
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05		x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29217		Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0018/MNDT-2022-0018.md		x_refsource_MISCThird Party Advisory