High 1 exploited CVE SEVD-2018-095-01 14 CVEs

Security Notification - U.motion Builder software

Published Apr 5, 2018 · Updated Feb 11, 2020 · Revision 3

Vendor: Schneider Electric Product: U.motion Builder Software

Summary

Schneider Electric is aware of an exploit that targets Schneider Electric’s U.motion Builder
software. It is imperative customers cease using U.motion Builder software and remove it from
their systems immediately.

Vulnerabilities 14

Critical 9.8

CVE-2017-7494 Exploited · Ransomware Public exploit EPSS 99%

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…

Samba Samba samba samba Debian Ubuntu Azure Linux Alpine

May 30, 2017
KEV Mar 30, 2023
Unscored —

CVE-2018-7763

The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. T…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7764

The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to …

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7765 Scanner template

The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software v…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7766

The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software version…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7767

The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions p…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7768

The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7769

The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions pr…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7770

The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions pri…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7771

The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions p…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7772

The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.moti…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7773

The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions pr…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7776

The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. Sys…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018
Unscored —

CVE-2018-7777 Public exploit EPSS 32%

The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider El…

Schneider Electric U.Motion ICS / OT

Jul 3, 2018

Revision history

2020-02-11 #1.2.0
Updated remediation section and overview section
2018-04-19 #1.1.0
Removed CVE-2018-7775 as it is a duplicate of CVE-2017-9960
2018-04-05 #1.0.0
Original Release

References

Security Notification – U.motion Builder software - SEVD-2018-095-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-095-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2018-095-01-Umotion-Builder_V1.2.pdf
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/