2 lines
2.3 KiB
JSON
2 lines
2.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebHMI – Deployed with EcoStruxure Power Automation System","vendor":"Schneider Electric","versions":[{"status":"affected","version":"WebHMI v4.1.0.0 and prior when deployed with EPAS User Interface 2.6.30.19 and prior"}]}],"source":"cybersecurity@se.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an\nattacker to execute unauthorized commands when a system’s default password credentials have not been\nchanged on first use. The default username is not displayed correctly in the WebHMI interface."},{"lang":"es","value":"CWE-1188: Existe una vulnerabilidad de inicialización de un recurso con un valor predeterminado inseguro que podría provocar que un atacante ejecute comandos no autorizados cuando las credenciales de contraseña predeterminadas de un sistema no se hayan cambiado en el primer uso. El nombre de usuario predeterminado no se muestra correctamente en la interfaz WebHMI."}],"id":"CVE-2025-1960","lastModified":"2026-06-17T08:40:26.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"cybersecurity@se.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1960","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-03-12T15:56:56.322926Z","version":"2.0.3"}}]},"published":"2025-03-12T16:15:20.797","references":[{"source":"cybersecurity@se.com","url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-03.pdf"}],"sourceIdentifier":"cybersecurity@se.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"cybersecurity@se.com","type":"Secondary"}]}
|