Critical ICSA-18-163-01 4 CVEs

Schneider Electric U.motion Builder

Published Jun 12, 2018 · Updated Jun 12, 2018

Vendor: Schneider Electric Product: U.motion Builder

Summary

Successful exploitation of these vulnerabilities could allow remote code execution.

Vulnerabilities 4

Unscored —

CVE-2018-7784

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data o…

Schneider Electric U.motion Builder ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7785

In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authenticat…

Schneider Electric U.motion Builder ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7786

In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability ex…

Schneider Electric U.motion Builder ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7787

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validat…

Schneider Electric U.motion Builder ICS / OT

Jul 3, 2018

Revision history

2018-06-12 #1
ICSA-18-163-01 Schneider Electric U.motion Builder

References

ICS Advisory ICSA-18-163-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-163-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B