CVE Vulnerability

CVE-2018-7239

A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/ Vendor Advisory
http://www.securityfocus.com/bid/103338 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-02 Third Party Advisory US Government Resource
Configurations

Configuration 1

cpe:2.3:a:schneider-electric:somove:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv320_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv340_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv600_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv900_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv32_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv71_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv61_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv_lift_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv31_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv312_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv212_dtm:*:*:*:*:*:*:*:*
cpe:2.3:a:schneider-electric:atv12_dtm:*:*:*:*:*:*:*:*
Information

Published : 2018-03-09 11:29

Updated : 2018-03-26 03:22

NVD link : CVE-2018-7239

Mitre link : CVE-2018-7239

Products Affected
No products.
CWE
CWE-426

Untrusted Search Path