Schneider Electric SE Vulnerabilities and Affected Products
Vulnerabilities associated with IIoT Monitor 3.1.38.
Products
Clear product- U.Motion20 vulnerabilities
- Pelco Sarix Professional12 vulnerabilities
- Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR02008 vulnerabilities
- 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS4 vulnerabilities
- Citect Anywhere4 vulnerabilities
- IIoT Monitor 3.1.384 vulnerabilities
- Modicon M221, all references, all versions prior to firmware V1.6.2.04 vulnerabilities
- Modicon M5804 vulnerabilities
- PowerSCADA Anywhere4 vulnerabilities
- U.motion Builder4 vulnerabilities
- Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)3 vulnerabilities
- EVLink Parking v3.2.0-12_v1 and earlier3 vulnerabilities
- Modicon M3403 vulnerabilities
- Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions)3 vulnerabilities
- Modicon Quantum3 vulnerabilities
- Pelco Sarix Professional V13 vulnerabilities
- Pelco VideoXpert Enterprise3 vulnerabilities
- Ampla MES2 vulnerabilities
- BMXNOR0200H Ethernet / Serial RTU module2 vulnerabilities
- ClearSCADA2 vulnerabilities
- Modicon Premium2 vulnerabilities
- Modicon Premium, Modicon Quantum, Modicon M340, BMXNOR02002 vulnerabilities
- SoMachine HVAC Programming Software2 vulnerabilities
- U.motion Server2 vulnerabilities
- Wiser for KNX2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-7839MEDIUM | A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. CWE-310Feb 6, 2019 | CVSS5.5v3.0 | EPSS0.325% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-7837HIGH | An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its output and expose restricted information. CWE-611Dec 24, 2018 | CVSS7.5v3.0 | EPSS1.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-7836CRITICAL | An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files. CWE-434Dec 24, 2018 | CVSS9.8v3.0 | EPSS32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-7835HIGH | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user. CWE-22Dec 24, 2018 | CVSS7.5v3.0 | EPSS1.76% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |