CVE-2023-2161 MEDIUM

CVE-2023-2161

Vendor Schneider Electric
Product OPC Factory Server (OFS)
Weakness CWE-611 · XXE
Published May 16, 2023
Last update January 22, 2025

CVSS base score

5.0/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user. 

Key dates

02Disclosure timeline

May 16, 2023 CVE published
January 22, 2025 Record updated