CVE-2022-2988mediumCWE-787

CVE-2022-2988: medium-severity vulnerability in Schneider Electric SoMachine HVAC

Published · Updated

Follow this CVE+ Monitor SoMachine HVAC+ Monitor EcoStruxure Machine Expert – HVAC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Schneider Electric · EcoStruxure Machine Expert – HVACSchneider Electric · SoMachine HVAC