CVE-2023-25552 HIGH

CVE-2023-25552

Vendor Schneider Electric
Product StruxureWare Data Center Expert
Weakness CWE-862 · Missing authorization
Published April 18, 2023
Last update March 3, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)

Key dates

02Disclosure timeline

April 18, 2023 CVE published
March 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23955 WordPress Xola plugin <= 1.6 - Broken Access Control vulnerability CVE-2023-48274 WordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerability CVE-2023-33994 WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability CVE-2024-47362 WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability CVE-2023-27437 WordPress Event Espresso 4 Decaf plugin <= 4.10.44.decaf - Bypass vulnerability