CVE-2022-22807 Information

Description

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB HMIBSCEA53D1EDS HMIBSCEA53D1EDM HMIBSCEA53D1EDL HMIBSCEA53D1ESS HMIBSCEA53D1ESM HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Reference

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-02 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.4