PT-2018-18285 · Schneider Electric · Schneider Electric Software Update

Published 2018-11-02 · Updated 2018-12-27 · CVE-2018-7799

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Schneider Electric Software Update (SESU) versions prior to V2.2.0

Description: A DLL hijacking issue exists, which could allow an attacker to execute arbitrary code on the targeted system when a specific DLL file is placed.

Recommendations: For versions prior to V2.2.0, update to version V2.2.0 or later to resolve the issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2018-7799

Affected Products

Schneider Electric Software Update

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-7799 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2018-298-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7799 · Vendor Advisory
• http://securityfocus.com/bid/105951 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-305-02 · Note