CVE-2017-9961
HIGHSchneider Electric's Pro-Face GP Pro EX <4.07.000 - RCE
Title source: llmDescription
A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. Malicious code installation requires an access to the computer. By placing a specific DLL/OCX file, an attacker is able to force the process to load arbitrary DLL and execute arbitrary code in the context of the process.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100114
Vendor Advisory x_refsource_confirm
http://www.schneider-electric.com/en/download/document/SEVD-2017-195-01/
Scores
CVSS v3
7.8
EPSS
0.0010
EPSS Percentile
26.7%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (2)
Schneider Electric SE/ProFace GP-Pro EX
version 4.07.000
schneider-electric/pro-face_gp_pro_ex
4.07.000
Published
Sep 26, 2017
Tracked Since
Feb 18, 2026