Severity
Medium
Analysis Summary
CVE-2024-8530 CVSS:5.9
Schneider Electric Data Center Expert could allow a remote attacker to obtain sensitive information, caused by a missing authentication for critical function vulnerability. By accessing an already generated “logcaptures” archive directly using HTTPS, an attacker could exploit this vulnerability to obtain private data.
CVE-2024-8531 CVSS:7.2
Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is manipulated to include arbitrary bash scripts that are executed as root.
Impact
- Information Theft
- Data Manipulation
Indicators of Compromise
CVE
- CVE-2024-8530
- CVE-2024-8531
Affected Vendors
Schneider Electric
Affected Products
- Schneider Electric Data Center Expert - Versions 8.1.1.3 and prior
Remediation
Refer to Schneider Electric Security Advisory for patch, upgrade or suggested workaround information.