TI-2022-08199 Aliases CVE-2022-24319 GHSA-xvfg-5fqf-m93j

Improper certificate validation in ClearSCADA , EcoStruxure Geo SCADA Expert 2019…

LOW 27CWE-295Published 2022-02-09 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

Why it matters now

EPSS 0.00575 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)	ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)	—	No fix listed	CNA

ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Vendor— Affected ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:schneider-electric:clearscada:-:::::::*	not specified by NVD	Vulnerable	Schneider Electric
cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2019::::::::	all versions	Vulnerable	Schneider Electric
cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2020::::::::	all versions	Vulnerable	Schneider Electric

cpe:2.3:a:schneider-electric:clearscada:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2019:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2020:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-24319
2026-10-03 Alias added: GHSA-xvfg-5fqf-m93j

References

Patch 1

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05

Advisory 1

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0018/MNDT-2022-0018.md

TI-2017-03931 Improper input validation in Schneider Electric ClearSCADA CVSS 3.0HIGH 7.5
TI-2022-08201 Improper check for unusual conditions in ClearSCADA , EcoStruxure Geo SCADA Expert 2019… CVSS 3.1HIGH 7.5
TI-2022-08198 A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause… CVSS 3.1HIGH 7.5
TI-2019-04887 Improper authentication in EcoStruxure Geo SCADA Expert with initial releases before 1… CVSS 3.1HIGH 7.8
TI-2023-00564 Improper output encoding in Schneider Electric EcoStruxure Geo SCADA Expert 2019 CVSS 3.1MEDIUM 5.3
TI-2021-05622 Use of Password Hash with Insufficient Computational Effort vulnerability exists in… CVSS 3.1MEDIUM 6.7

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences