Schneider Electric U.motion Builder (Update A)
A successful exploit of these vulnerabilities could allow an attacker to execute arbitrary commands or compromise the confidentiality, integrity, and availability of the system.
describes (22)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-7777US | high8.8 | Exploit | ||
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A… | ||||
| CVE-2018-7776US | medium4.3 | — | ||
The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sen… | ||||
| CVE-2018-7774US | high8.8 | — | ||
The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject… | ||||
| CVE-2018-7773US | high8.8 | — | ||
The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subjec… | ||||
| CVE-2018-7772US | high8.8 | — | ||
The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying… | ||||
| CVE-2018-7771US | high8.0 | — | ||
The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a… | ||||
| CVE-2018-7770US | medium6.5 | — | ||
The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The applet allows callers to select arbitrary f… | ||||
| CVE-2018-7769US | high8.8 | — | ||
The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subjec… | ||||
| CVE-2018-7768US | high8.8 | — | ||
The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is sub… | ||||
| CVE-2018-7767US | high8.8 | — | ||
The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subje… | ||||
| CVE-2018-7766US | high8.8 | — | ||
The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is su… | ||||
| CVE-2018-7765US | high8.8 | — | ||
The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query… | ||||
| CVE-2018-7764US | medium4.3 | — | ||
The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the p… | ||||
| CVE-2018-7763US | medium4.3 | — | ||
The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerabili… | ||||
| CVE-2017-9960US | medium5.3 | — | ||
An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error provides more inform… | ||||
| CVE-2017-9959US | medium5.5 | — | ||
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in session from unauthenticated users, supporti… | ||||
| CVE-2017-9958US | high7.8 | — | ||
An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an improper handling of the system configuration… | ||||
| CVE-2017-9957US | critical9.8OT elevated | — | ||
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded passwor… | ||||
| CVE-2017-9956US | high7.3OT elevated | — | ||
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An… | ||||
| CVE-2017-7974US | critical9.8 | — | ||
A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can execute… | ||||
references
External citations — patches, advisories, analysis.
remediations (44)
- MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - MitigationU.motion Builder
Schneider Electric's security notice SEVD-2017-178-01 is available
http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
- FixedU.motion Builder
Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan