Se Ecostruxure Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

2021-08-1000:00:00

www.tenable.com

0.002 Low

EPSS

Percentile

61.6%

JSON

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.

File data ot_500405.nasl

VendorProductVersionCPE
seecostruxure_machine_expert*cpe:2.3:a:se:ecostruxure_machine_expert:*:*:*:*:*:*:*:*
sesomachine_basic*cpe:2.3:a:se:somachine_basic:*:*:*:*:*:*:*:*
semodicon_m100_firmware*cpe:2.3:o:se:modicon_m100_firmware:*:*:*:*:*:*:*:*
semodicon_m200_firmware*cpe:2.3:o:se:modicon_m200_firmware:*:*:*:*:*:*:*:*
semodicon_m221_firmware*cpe:2.3:o:se:modicon_m221_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
se	ecostruxure_machine_expert	*	cpe:2.3:a:se:ecostruxure_machine_expert::::::::
se	somachine_basic	*	cpe:2.3:a:se:somachine_basic::::::::
se	modicon_m100_firmware	*	cpe:2.3:o:se:modicon_m100_firmware::::::::
se	modicon_m200_firmware	*	cpe:2.3:o:se:modicon_m200_firmware::::::::
se	modicon_m221_firmware	*	cpe:2.3:o:se:modicon_m221_firmware::::::::