Schneider Electric SE vulnerabilities, page 3
117 vulnerabilities
Known vulnerabilities in Schneider Electric SE products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 49 products.
CVE-2018-7800schneider electric seevlink parking v3.2.0-12_v1 and earlier+1
EPSS score3.95%
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device.CVE-2018-7767schneider electric seu.motion+1EPSS score0.97%
The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the type input parameter.CVE-2018-7789schneider electric semodicon m221, all references, all versions prior to firmware v1.6.2.0+1EPSS score2.80%
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to remotely reboot Modicon M221 using crafted programing protocol frames.CVE-2018-7812schneider electric seembedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200EPSS score3.71%
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.CVE-2018-7782schneider electric sepelco sarix professional v1+20EPSS score0.80%
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.CVE-2018-7771schneider electric seu.motion+1EPSS score1.45%
The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.CVE-2018-7237schneider electric sepelco sarix professional+20EPSS score1.72%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file'CVE-2018-7780schneider electric sepelco sarix professional v1+20EPSS score1.19%
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".CVE-2018-7243schneider electric se66074 mge network management card transverse installed in mge ups and mge sts+1EPSS score2.77%
An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to get a full access to device, bypassing the authorization system.CVE-2018-7785schneider electric seu.motion builder+1EPSS score2.97%
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass.CVE-2018-7764schneider electric seu.motion+1EPSS score1.33%
The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.CVE-2018-7783schneider electric sesomachine basic+1EPSS score1.56%
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.CVE-2018-7245schneider electric se66074 mge network management card transverse installed in mge ups and mge sts+1EPSS score1.24%
An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to change UPS control and shutdown parameters or other critical settings without authorization.CVE-2018-7798schneider electric semodicon m221, all versionsEPSS score0.66%
A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device.CVE-2018-7763schneider electric seu.motion+1EPSS score1.33%
The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerability.CVE-2018-7776schneider electric seu.motion+1EPSS score0.68%
The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.CVE-2018-7801schneider electric seevlink parking v3.2.0-12_v1 and earlier+1EPSS score6.30%
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code execution is performed.CVE-2018-7227schneider electric sepelco sarix professional+20EPSS score1.20%
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially crafted URLs without authentication that can reveal sensitive information to an attacker.CVE-2018-7230schneider electric sepelco sarix professional+20EPSS score1.58%
A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.CVE-2018-7239schneider electric sesomove+13EPSS score2.82%
A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.