QID 591217

Date Published:

QID 591217: Schneider Electric EcoStruxure Panel Server Box Multiple Vulnerabilties (SEVD-2022-284-02)

The EcoStruxure Panel Server Box (PAS900) product is a cloud connected gateway with 4G/WIFI/Ethernet that supports Modbus TCP/RTU for south communication.

CVE-2022-30790 - Out-of-Bounds Write vulnerability exists that could cause arbitrary writes when crafted malformed packets are received from a local network while U-boot is running.
CVE-2022-30552 - Buffer Copy without Checking Size of Input vulnerability exists that could cause Denial of Service when a specially crafted fragmented IP Datagram with an invalid total length is received from a local network while U-boot is running.

Affected Versions
EcoStruxure Panel Server Box (PAS900) V3.1.16 and prior

QID Detection Logic (Authenticated)
QID checks for the Vulnerable version using passive scanning

Successful exploitation of these vulnerabilities could allow arbitrary code execution and disclose information.

  • CVSS V3 rated as High - 7.8 severity.
  • CVSS V2 rated as High - 7.2 severity.
    • Solution

    Customers are advised to refer to CERT MITIGATIONS section SEVD-2022-284-02 for affected packages and patching details.

    Vendor References

    CVEs related to QID 591217

    CVE-2022-30790 | CVE-2022-30552 |
    Software Advisories
    Advisory ID Software Component Link
    SEVD-2022-284-02 URL Logo download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-02-EcoStruxure_Panel_Server_Box_PAS900_Security_Notification.pdf&_ga=2.83643921.624978513.1669086152-875239440.1662434919
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].