Sign-up

ID

VAR-202304-1397


CVE

CVE-2023-29410


TITLE

Schneider Electric Conext Gateway Input Validation Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2023-40173 // CNNVD: CNNVD-202304-1581

DESCRIPTION

A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute. Schneider Electric of insighthome firmware, insightfacility firmware, conext gateway There is an input validation vulnerability in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Schneider Electric Conext Gateway is a series of gateway equipment of French Schneider Electric (Schneider Electric). The vulnerability stems from incorrect input validation

Trust: 2.25

sources: NVD: CVE-2023-29410 // JVNDB: JVNDB-2023-008922 // CNVD: CNVD-2023-40173 // VULMON: CVE-2023-29410

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-40173

AFFECTED PRODUCTS

vendor:schneider electricmodel:insighthomescope:ltversion:1.16

Trust: 1.0

vendor:schneider electricmodel:insighthomescope:eqversion:1.16

Trust: 1.0

vendor:schneider electricmodel:conext gatewayscope:ltversion:1.16

Trust: 1.0

vendor:schneider electricmodel:insightfacilityscope:eqversion:1.16

Trust: 1.0

vendor:schneider electricmodel:conext gatewayscope:eqversion:1.16

Trust: 1.0

vendor:schneider electricmodel:insightfacilityscope:ltversion:1.16

Trust: 1.0

vendor:schneider electricmodel:insighthomescope: - version: -

Trust: 0.8

vendor:schneider electricmodel:insightfacilityscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:conext gatewayscope: - version: -

Trust: 0.8

vendor:schneidermodel:electric schneider electric conext gateway buildscope:lteversion:<=v1.16004

Trust: 0.6

sources: CNVD: CNVD-2023-40173 // JVNDB: JVNDB-2023-008922 // NVD: CVE-2023-29410

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-29410
value: HIGH

Trust: 1.0

cybersecurity@se.com: CVE-2023-29410
value: HIGH

Trust: 1.0

NVD: CVE-2023-29410
value: HIGH

Trust: 0.8

CNVD: CNVD-2023-40173
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202304-1581
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-40173
severity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:L/AU:M/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-29410
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cybersecurity@se.com: CVE-2023-29410
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-29410
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-40173 // JVNDB: JVNDB-2023-008922 // CNNVD: CNNVD-202304-1581 // NVD: CVE-2023-29410 // NVD: CVE-2023-29410

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-008922 // NVD: CVE-2023-29410

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202304-1581

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202304-1581

PATCH

title:Patch for Schneider Electric Conext Gateway Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/420871

Trust: 0.6

title:Schneider Electric Conext Gateway Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=235384

Trust: 0.6

sources: CNVD: CNVD-2023-40173 // CNNVD: CNNVD-202304-1581

EXTERNAL IDS

db:NVDid:CVE-2023-29410

Trust: 3.9

db:SCHNEIDERid:SEVD-2023-101-02

Trust: 2.5

db:JVNDBid:JVNDB-2023-008922

Trust: 0.8

db:CNVDid:CNVD-2023-40173

Trust: 0.6

db:CNNVDid:CNNVD-202304-1581

Trust: 0.6

db:VULMONid:CVE-2023-29410

Trust: 0.1

sources: CNVD: CNVD-2023-40173 // VULMON: CVE-2023-29410 // JVNDB: JVNDB-2023-008922 // CNNVD: CNNVD-202304-1581 // NVD: CVE-2023-29410

REFERENCES

url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2023-101-02&p_endoctype=security+and+safety+notice&p_file_name=sevd-2023-101-02.pdf

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2023-29410

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2023-29410/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2023-40173 // VULMON: CVE-2023-29410 // JVNDB: JVNDB-2023-008922 // CNNVD: CNNVD-202304-1581 // NVD: CVE-2023-29410

SOURCES

db:CNVDid:CNVD-2023-40173
db:VULMONid:CVE-2023-29410
db:JVNDBid:JVNDB-2023-008922
db:CNNVDid:CNNVD-202304-1581
db:NVDid:CVE-2023-29410

LAST UPDATE DATE

2024-08-14T14:17:18.550000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-40173date:2023-05-23T00:00:00
db:VULMONid:CVE-2023-29410date:2023-04-19T00:00:00
db:JVNDBid:JVNDB-2023-008922date:2023-12-04T04:59:00
db:CNNVDid:CNNVD-202304-1581date:2023-05-04T00:00:00
db:NVDid:CVE-2023-29410date:2023-04-28T01:25:19.217

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-40173date:2023-04-27T00:00:00
db:VULMONid:CVE-2023-29410date:2023-04-18T00:00:00
db:JVNDBid:JVNDB-2023-008922date:2023-12-04T00:00:00
db:CNNVDid:CNNVD-202304-1581date:2023-04-18T00:00:00
db:NVDid:CVE-2023-29410date:2023-04-18T22:15:08.067