Description
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric SE | U.Motion | U.motion Builder Software, all versions prior to v1.3.4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection EDB-47991 · webapps · Feb 3, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- SEVD-2018-095-01 Security Notification - U.motion Builder software Schneider Electric CPCERT · Feb 11, 2020
- ICSA-17-180-02 Schneider Electric U.motion Builder (Update A) CISA ICS & IT advisories · Jan 8, 2019