Schneider Electric SE vulnerabilities
117 vulnerabilities
Known vulnerabilities in Schneider Electric SE products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 49 products.
Products
49- U.Motion20 vulnerabilities
- Pelco Sarix Professional12 vulnerabilities
- Embedded Web Servers In All Modicon M340, Premium, Quantum Plcs And Bmxnor02008 vulnerabilities
- 66074 MGE Network Management Card Transverse Installed In MGE UPS And MGE STS4 vulnerabilities
- Citect Anywhere4 vulnerabilities
- Iiot Monitor 3.1.384 vulnerabilities
- Modicon M221, All References, All Versions Prior To Firmware V1.6.2.04 vulnerabilities
- Modicon M5804 vulnerabilities
- Powerscada Anywhere4 vulnerabilities
- U.Motion Builder4 vulnerabilities
- Eurotherm By Schneider Electric Guicon V2.0 (Gold Build 683.0)3 vulnerabilities
- Evlink Parking V3.2.0 12 V1 And Earlier3 vulnerabilities
- Modicon M3403 vulnerabilities
- Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (See Security Notification For Specific Versions)3 vulnerabilities
- Modicon Quantum3 vulnerabilities
- Pelco Sarix Professional V13 vulnerabilities
- Pelco Videoxpert Enterprise3 vulnerabilities
- Ampla MES2 vulnerabilities
- Bmxnor0200H Ethernet / Serial RTU Module2 vulnerabilities
- Clearscada2 vulnerabilities
- Modicon Premium2 vulnerabilities
- Modicon Premium, Modicon Quantum, Modicon M340, Bmxnor02002 vulnerabilities
- Somachine HVAC Programming Software2 vulnerabilities
- U.Motion Server2 vulnerabilities
- Wiser For KNX2 vulnerabilities
- APC UPS Network Management Card 2 AOS1 vulnerabilities
- Data Center Expert Versions 7.5.0 And Earlier1 vulnerabilities
- Data Center Operation All Versions1 vulnerabilities
- Evlink Charging Station1 vulnerabilities
- Foxview HMI Scada (All Foxboro DCS, Foxboro Evo, And IA Series Versions Prior To Foxboro DCS Control Core Services 9.4 (CCS 9.4) And Foxview 10.5.)1 vulnerabilities
- Magelis HMI Panels1 vulnerabilities
- Micom P540D Range With Legacy Ethernet Board1 vulnerabilities
- Modicon M221, All Versions1 vulnerabilities
- Modicon M340, Modicon Premium, Modicon Quantum, Bmxnor02001 vulnerabilities
- Modicon M340, Modicon Premium, Modicon Quantum, Bmxnor02011 vulnerabilities
- Modicon M340, Modicon Premium, Modicon Quantum, Bmxnor02021 vulnerabilities
- Modicon M340, Modicon Premium, Modicon Quantum, Bmxnor02031 vulnerabilities
- Modicon Quantum 140 Noe771X11 vulnerabilities
- Powerlogic Pm5560 Prior To FW Version 2.5.41 vulnerabilities
- Powersuite 2, All Released Versions (Vw3A8104 & Patches)1 vulnerabilities
- Pro Face GP Pro EX V4.08 And Previous Versions1 vulnerabilities
- Proface GP Pro EX1 vulnerabilities
- Schneider Electric Software Update (Sesu), All Versions Prior To V2.2.01 vulnerabilities
- Somachine Basic1 vulnerabilities
- Somachine HVAC1 vulnerabilities
- Somove1 vulnerabilities
- Spacelynk1 vulnerabilities
- Vampset1 vulnerabilities
- Zelio Soft 2 V5.1 And Prior Versions1 vulnerabilities
CVE-2018-7228schneider electric sepelco sarix professional+20
EPSS score2.19%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and get the administrator privileges.CVE-2018-7231schneider electric sepelco sarix professional+20EPSS score2.05%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'.CVE-2018-7773schneider electric seu.motion+1EPSS score0.97%
The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter.CVE-2018-7786schneider electric seu.motion builder+1EPSS score0.75%
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.CVE-2018-7762schneider electric semodicon m340, modicon premium, modicon quantum, bmxnor0203+57EPSS score1.29%
A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow.CVE-2018-7759schneider electric semodicon m340, modicon premium, modicon quantum, bmxnor0200+57EPSS score1.29%
A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified (instead of the buffer size) as the number of bytes to be copied.CVE-2018-7772schneider electric seu.motion+1EPSS score0.97%
The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.CVE-2018-7234schneider electric sepelco sarix professional+20EPSS score0.96%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.CVE-2018-7229schneider electric sepelco sarix professional+20EPSS score2.19%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials.CVE-2018-7768schneider electric seu.motion+1EPSS score0.97%
The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the tpl input parameter.CVE-2018-7837schneider electric seiiot monitor 3.1.38+1EPSS score1.20%
An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its output and expose restricted information.CVE-2018-7811schneider electric seembedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200EPSS score3.50%
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web serverCVE-2018-7831schneider electric seembedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200EPSS score0.64%
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.CVE-2018-7830schneider electric seembedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200EPSS score2.42%
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for ~1 minute by sending a specially crafted HTTP request.CVE-2018-7794schneider electric semodicon m580, modicon m340, modicon quantum, modicon premium (see security notification for specific versions)+29EPSS score1.40%
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when reading data with invalid index using Modbus TCP.CVE-2018-7761schneider electric semodicon m340, modicon premium, modicon quantum, bmxnor0202+57EPSS score2.10%
A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution.CVE-2018-7817schneider electric sezelio soft 2 v5.1 and prior versions+1EPSS score3.04%
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.CVE-2018-7835schneider electric seiiot monitor 3.1.38+1EPSS score1.76%
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user.CVE-2018-7820schneider electric seapc ups network management card 2 aos+4EPSS score1.03%
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.CVE-2018-7799schneider electric seschneider electric software update (sesu), all versions prior to v2.2.0+1EPSS score2.79%
A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbitrary code on the targeted system when placing a specific DLL file.