Schneider Electric ConneXium Network Manager Files Accessible to External Parties Vulnerability

A vulnerability allowing files or directories to be accessed by external parties over HTTPS has been identified in Schneider Electric's ConneXium Network Manager software, specifically in version 2.0.01. This vulnerability could lead to information leakage and potential privilege escalation, especially following a man-in-the-middle attack.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information and allow for privilege escalation on the affected system.

Remediation

Users are advised to disable the web server, which is disabled by default, and to follow workstation, network, and site-hardening guidelines available in the Schneider Electric Recommended Cybersecurity Best Practices document.