CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account.

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account.

Schneider Electric is aware of multiple vulnerabilities in its SpaceLogic AS-P and AS-B products. The SpaceLogic AS-P system controller performs key functionality: control logic, trend logging & alarm supervision, and supports communication & connectivity to I/O & field buses. The Spacelogic AS-B is a compact, all-in-one server or controller for EcoStruxure Building Operation. Failure to apply the remediation provided below may risk exposure of SNMP credentials and escalation of privileges which could cause unauthorized changes to the system configuration.