PT-2019-3828 · Schneider Electric · Somachine+2

Published 2019-09-17 · Updated 2022-02-03 · CVE-2019-6826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoMachine versions prior to 2.4.1 SoMachine HVAC versions prior to 2.4.1 SoMove (affected versions not specified)

Description The issue is related to the use of an untrusted search path, which could allow an attacker to load a malicious DLL library and execute arbitrary code on the system running the affected software. This could lead to arbitrary code execution when a malicious DLL library is loaded by the product.

Recommendations For SoMachine versions prior to 2.4.1: Update to a version later than 2.4.1 to resolve the issue. For SoMachine HVAC versions prior to 2.4.1: Update to a version later than 2.4.1 to resolve the issue. For SoMove: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2019-04187

CVE-2019-6826

Affected Products

Somachine

Somachine Hvac

Somove

References · 6

• https://schneider-electric.com/en/download/document/SEVD-2019-225-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6826 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6826 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04187 · Security Note
• https://t.me/cvenotify/26219 · Telegram Post
• https://t.me/cvenotify/19914 · Telegram Post