« Volver al listado

CVE-2018-7239

Estado: ModificadaAlta (7.8)—

A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (13)

Schneider-electric — Atv12 DTMSchneider-electric — Atv212 DTMSchneider-electric — Atv312 DTMSchneider-electric — Atv31 DTMSchneider-electric — Atv320 DTMSchneider-electric — Atv32 DTMSchneider-electric — Atv340 DTMSchneider-electric — Atv600 DTMSchneider-electric — Atv61 DTMSchneider-electric — Atv71 DTMSchneider-electric — Atv900 DTMSchneider-electric — ATV Lift DTMSchneider-electric — Somove

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-7239",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schneider Electric SE",
          "product": "SoMove",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-09T23:29:00.967",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103338",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-065-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103338",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-065-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de secuestro de DLL en SoMove Software de Schneider Electric y en los componentes de software DTM asociados, en todas las versiones anteriores a la 2.6.2. Esto podría permitir que un atacante ejecute código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T02:02:51.077",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv_lift_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F0F8212-5CC6-4EB7-9F37-4587FC849A54",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv12_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70DDF782-E80B-41A6-88F0-52D3BCCD0BE6",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv212_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A9E382F-DBB4-4B24-81C7-EE33B5248935",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv31_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2429408E-48C9-4F97-A918-4DDECF6A7AB2",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv312_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44D79762-E0D3-4DB9-8DD8-AE6A93953411",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv32_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC70CB2D-2AA8-40EC-97BC-0527D5F100ED",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv320_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D1862C8-5571-4DAC-B9F0-96DC3F2F846F",
              "versionEndExcluding": "1.1.6"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv340_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB77B51C-CA0B-4C6E-91D2-41C450C6214E",
              "versionEndExcluding": "1.2.3"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv600_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE8C39E7-A682-4453-945F-D1DFC9418A7C",
              "versionEndExcluding": "1.8.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv61_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "988EB546-BB63-4DEF-800E-5C5A3C796163",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv71_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "848353C2-B49E-4B88-A57A-C783BF47C84C",
              "versionEndExcluding": "12.7.0"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:atv900_dtm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BA8B718-4947-41FE-9DDC-DA3AB85992B3",
              "versionEndExcluding": "1.3.5"
            },
            {
              "criteria": "cpe:2.3:a:schneider-electric:somove:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD8AD349-3536-4244-8D10-D860A5A7F1FF",
              "versionEndExcluding": "2.6.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}