PT-2019-6001 · Proclima · Proclima

Published 2019-07-11 · Updated 2022-09-03 · CVE-2019-6825

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProClima versions prior to 8.0.0

Description A vulnerability exists in the software that could allow a malicious DLL file, with the same name as any resident DLLs inside the software installation, to execute arbitrary code. This issue is related to an uncontrolled search path element. Exploitation of the vulnerability may allow an attacker to execute arbitrary code.

Recommendations For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the software installation directory to minimize the risk of exploitation. Avoid using the software until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2021-04274

CVE-2019-6825

Affected Products

Proclima

References · 6

• https://schneider-electric.com/en/download/document/SEVD-2019-162-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04274 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6825 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-162-01-ProClima.pdf&p_Doc_Ref=SEVD-2019-162-01 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-162-01-ProClima.pdf&p_Doc_Ref=SEVD-2019-162-01 · Note