{"id":"CVE-2013-0655","aliases":["EUVD-2013-0666","GHSA-8q56-7r9c-2j9q"],"status":"published","title":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure...","description":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02906,"percentile":0.87059,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2013-01-21T16:00:00Z","modified":"2026-06-16T23:49:51Z","products":[{"vendor":"schneider-electric","product":"software_update_utility"}],"references":[{"url":"http://www.schneider-electric.com/download/ww/en/details/29960967-SE-Software-Update-Utility-Vulnerability-Disclosure/?reference=SEVD-2013-009-01","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130109_advisory_of_vulnerability_affecting_schneider_electric_s_software_upda.xml","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0655"},{"url":"https://github.com/advisories/GHSA-8q56-7r9c-2j9q"}],"sources":{"cve":[{"id":"CVE-2013-0655","description":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.","status":"published","published":"2013-01-21T16:00:00Z","modified":"2024-09-17T00:51:21.342Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2013-0666","description":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.","status":"published","published":"2013-01-21T16:00:00Z","modified":"2024-09-17T00:51:21Z","updated_at":"2026-11-03T00:28:54.932148Z"}],"ghsa":[{"id":"GHSA-8q56-7r9c-2j9q","title":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure...","description":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.","status":"published","published":"2022-05-17T05:16:53Z","modified":"2023-01-28T05:03:50Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:44:03.582616Z"}],"nvd":[{"id":"CVE-2013-0655","description":"The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.","status":"published","published":"2013-01-21T16:55:01.793Z","modified":"2026-06-16T23:49:51.187Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:21.222658Z"}]}}