|2018-03-06||Other||Schneider Electric||ADLab of Venustech reported this vulnerability to NCCIC.||N/A||CVE-2018-7239 ||N/A||N/A||N/A|
# Schneider Electric SoMove Software and DTM Software Components
### VULNERABLE VENDOR
### VULNERABLE PRODUCT
SoMove software and DTM software components
ADLab of Venustech reported this vulnerability to NCCIC.
### AFFECTED PRODUCTS
Schneider Electric reports the vulnerability affects the following SoMove software and DTM software components:
SoMove software, versions prior to 2.6.2
ATV320 DTM, versions prior to 1.1.6
ATV340 DTM, versions prior to 1.2.3
ATV6xx DTM, versions prior to 1.8.0
ATV9xx DTM, versions prior to 1.3.5
AltivarDtmLibrary, versions prior to 12.7.0
ATV LIFT DTM
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.
### VULNERABILITY OVERVIEW
UNCONTROLLED SEARCH PATH ELEMENT CWE-427
An attacker may execute malicious DLL files that have been placed within the search path.
CVE-2018-7239 has been assigned to this vulnerability.
A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Critical Infrastructure Sectors: Critical manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
Schneider Electric has provided the following updates for the affected software packages:
ATV32 / ATV71 / ATV61 / ATV LIFT / ATV31_312 / ATV212 / ATV12 AltivarDtmLibraryV12.7.0
For more information on this vulnerability and its associated patches, please see Schneider Electric’s security notification SEVD-2018-060-01 on their website:
For further information related to cybersecurity in Schneider Electric products, please visit the company’s cybersecurity web page: