Summary
Schneider Electric is aware of multiple Microsoft Windows vulnerabilities in its Schneider Conext™ Advisor 2 & Conext™ Control V2 products.
The Conext™ Advisor 2 is a web portal with an efficient, task-oriented interface for managing and optimizing the performance of solar power plants and includes a complete suite of tools for professional users.
The Conext™ Control V2 is a Solar Power Plant monitoring solution.
Failure to apply the remediations provided below may risk remote code execution, which could result in undesired behavior within the operating system. An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system and then install programs; view, change, or delete data; or create new accounts with full user rights.
Vulnerabilities 11
-
Critical 10.0
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol …
KEV Feb 10, 2022 -
Critical 10.0
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…
KEV Nov 3, 2021 -
High 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
High 8.1
Certificate validation bypass on Windows in crypto/x509
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperl…
KEV Nov 3, 2021 -
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
Medium 6.5
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potent…
-
Medium 5.3
Windows NTLM Tampering Vulnerability
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downg…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
-
Unscored —
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated att…
Revision history
-
#1.0.0
Original Release
References
-
Conext™ Advisor & Conext™ Control V2 - SEVD-2021-285-05 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-285-05_Conext_Advisor_and_Conext_Control_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/