Description
CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service,
privilege escalation, and potentially kernel execution when a malicious actor with local user
access crafts a script/program using an IOCTL call in the Foxboro.sys driver.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure Foxboro DCS Core Control Services | Versions 9.8 and prior | — |
Advisories 2
- ICSA-24-345-02 Schneider Electric EcoStruxure Foxboro DCS Core Control Services CISA ICS & IT advisories · Jul 9, 2024
- SEVD-2024-191-02 EcoStruxureTM Foxboro DCS Core Control Services Schneider Electric CPCERT · Jul 9, 2024