A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.
A CWE-74: Hay una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales en una Salida Utilizada por un Componente Descendente ('Injection') en el software de programación EcoStruxure Machine Expert – Basic o SoMachine Basic (versiones en notificación de seguridad). El resultado de esta vulnerabilidad, la sustitución de la DLL, que podría permitir la transferencia de código malicioso al controlador.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-74
|
| [email protected] | Primary |
en
CWE-74
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_machine_expert | * | <built-in method update of dict object at 0x7e6110a57e00> | Application |
| schneider-electric | somachine_basic | * | <built-in method update of dict object at 0x7e60eb225480> | Application |
| schneider-electric | modicon_m100_firmware | * | <built-in method update of dict object at 0x7e6110a55540> | Operating System |
| schneider-electric | modicon_m200_firmware | * | <built-in method update of dict object at 0x7e6110a55080> | Operating System |
| schneider-electric | modicon_m221_firmware | * | <built-in method update of dict object at 0x7e6110a55740> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:somachine_basic:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_m100_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_m100:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_m200_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_m200:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_m221_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_m221:-:*:*:*:*:*:*:* |