SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-229407531] Schneider Electric SoMove Software and DTM Software Components

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2018-03-06OtherSchneider ElectricADLab of Venustech reported this vulnerability to NCCIC.N/ACVE-2018-7239 N/AN/AN/A

Source

						
							
								
#
# Schneider Electric SoMove Software and DTM Software Components
#


### VULNERABLE VENDOR
Schneider Electric


### VULNERABLE PRODUCT
SoMove software and DTM software components 


### RESEARCHER
ADLab of Venustech reported this vulnerability to NCCIC.


### AFFECTED PRODUCTS
Schneider Electric reports the vulnerability affects the following SoMove software and DTM software components:

SoMove software, versions prior to 2.6.2
ATV320 DTM, versions prior to 1.1.6
ATV340 DTM, versions prior to 1.2.3
ATV6xx DTM, versions prior to 1.8.0
ATV9xx DTM, versions prior to 1.3.5
AltivarDtmLibrary, versions prior to 12.7.0
ATV32 DTM
ATV71 DTM
ATV61 DTM
ATV LIFT DTM
ATV31/312 DTM
ATV212 DTM
ATV12 DTM



### IMPACT
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.


### VULNERABILITY OVERVIEW
UNCONTROLLED SEARCH PATH ELEMENT CWE-427
An attacker may execute malicious DLL files that have been placed within the search path.
CVE-2018-7239 has been assigned to this vulnerability.
A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)





### BACKGROUND
Critical Infrastructure Sectors: Critical manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France




### MITIGATION

Schneider Electric has provided the following updates for the affected software packages:

SoMove Software—SoMove_V2.6.3
https://www.schneider-electric.com/en/download/document/SoMove_FDT/


ATV320 DTM—Schneider_Electric_Altivar_Machine_ATV320_DTM_Library_V1.1.6
https://www.schneider-electric.com/en/download/document/ATV320_DTM_Library/


ATV340 DTM—Schneider_Electric_Altivar_Machine_ATV340_DTM_Library_V1.2.3
https://www.schneider-electric.com/en/download/document/ATV340_DTM_LibraryEN/


ATV6XX DTM—Schneider_Electric_Altivar_Process_ATV6xx_DTM_Library_V1.8.0
https://www.schneider-electric.com/en/download/document/ATV6xx_DTM_Library_EN/


ATV9XX DTM—Schneider-Electric-Altivar-Process-ATV9xx-DTM-Library-V1.3.5
https://www.schneider-electric.com/en/download/document/ATV9xx_DTM_Library_EN/


ATV32 / ATV71 / ATV61 / ATV LIFT / ATV31_312 / ATV212 / ATV12 AltivarDtmLibraryV12.7.0
https://www.schneider-electric.com/en/download/document/Altivar_DTM_Library/


For more information on this vulnerability and its associated patches, please see Schneider Electric’s security notification SEVD-2018-060-01 on their website:

https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/


For further information related to cybersecurity in Schneider Electric products, please visit the company’s cybersecurity web page:

http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page