CVE-2018-7784 Code injection in U.motion Builder
Attackers can execute arbitrary code or cause denial of service in Schneider Electric U.motion Builder via input string evaluation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7784?
CVE-2018-7784 is a critical code injection vulnerability in Schneider Electric SE U.motion Builder, published on 3 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application.
Weakness: CWE-20
Which versions are affected by CVE-2018-7784?
It affects 1 product.
Products include Schneider-Electric U.motion.
How do I fix CVE-2018-7784?
No fix has been published for CVE-2018-7784 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-7784 being exploited?
There is no known exploitation of CVE-2018-7784 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric SE U.motion Builder
Sources
Also known as GHSA-p42r-gh35-r237.