« Volver al listado

CVE-2023-29410

Estado: ModificadaAlta (8.8)—

A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Schneider-electric — Conext Gateway FirmwareSchneider-electric — Insightfacility FirmwareSchneider-electric — Insighthome Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-29410",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-29410",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-05T20:56:50.880042Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@se.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schneider Electric",
          "product": "InsightHome",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 Build 004",
              "versionType": "custom",
              "lessThanOrEqual": "prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Schneider Electric",
          "product": "InsightFacility",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 Build 004",
              "versionType": "custom",
              "lessThanOrEqual": "prior"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Schneider Electric",
          "product": "Conext Gateway",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 Build 004",
              "versionType": "custom",
              "lessThanOrEqual": "prior"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-04-18T22:15:08.067",
  "references": [
    {
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-02.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-02.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@se.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nA CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated\nattacker to gain the same privilege as the application on the server when a malicious payload is\nprovided over HTTP for the server to execute. \n\n \n\n\n\n"
    }
  ],
  "lastModified": "2026-06-17T05:49:59.433",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:insighthome_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "371B602D-2BB3-41CF-B07B-558B74AEC130",
              "versionEndExcluding": "1.16"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:insighthome_firmware:1.16:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "698CF5CB-17DC-405B-9C44-675A80320A65"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:insighthome_firmware:1.16:build_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "039691CA-D243-4D6D-912A-F130F7F6491C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:insighthome:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "37CAC057-7F0E-4375-99FE-AEE0EDDEA568"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:insightfacility_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18E2843D-745F-41D7-8B16-2CC18EC64290",
              "versionEndExcluding": "1.16"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:insightfacility_firmware:1.16:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F90B0024-6C86-4E85-AE83-F349D34E7416"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:insightfacility_firmware:1.16:build_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D81ACD8E-4B04-4BCB-894F-4A5828899C16"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:insightfacility:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F5011815-3D43-4AA4-9395-31788D06DA10"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:conext_gateway_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3524289C-ACF3-424E-9A1E-A777EBFB89F1",
              "versionEndExcluding": "1.16"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:conext_gateway_firmware:1.16:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62314597-62BC-4531-B5C8-61343262CE9E"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:conext_gateway_firmware:1.16:build_004:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD27299F-4422-4176-9DFD-86F2E4487366"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:conext_gateway:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E013171F-2BFB-4CB2-9C4B-4EB60A40B255"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}