Remote code execution

2018-02-1223:29:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.3%

JSON

A remote code execution vulnerability exists in Schneider Electric’s StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully crafted metadata allows for the file to be uploaded to any directory on the host machine information which could lead to remote code execution.

CPENameOperatorVersion
struxureon_gatewayle1.1.3

CPE	Name	Operator	Version
	struxureon_gateway	le	1.1.3

References

www.securityfocus.com/bid/103052

ics-cert.us-cert.gov/advisories/ICSA-18-046-04

www.schneider-electric.com/en/download/document/SEVD-2018-039-01/