CVE-2017-9961

Schneider Electric Pro-face GP-Pro EX (software) version 4.07.000 is affected by CVE-2017-9961: an Uncontrolled Search Path Element vulnerability (CWE-427) that can force a process to load an arbitrary DLL and execute code in the current process context. Exploitation is local (not remote) and req...

CVE-2017-9961

A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. Malicious code installation requires an access to the computer. By placing a specific DLL/OCX file, an attacker is able to force the process to load arbitrary DLL...

PT-2017-19313

Name of the Vulnerable Software and Affected Versions Schneider Electric's Pro-Face GP Pro EX version 4.07.000 Description A security issue exists that allows an attacker to execute arbitrary code. This can be achieved by placing a specific DLL/OCX file, which forces the process to load an...

Schneider Electric Pro-face GP-Pro EX Arbitrary Code Execution Vulnerability

Pro-face GP-Pro EX is the development software for Pro-face GP4000, GP4100, GP4000M, LT4000M, LT3000, EZ Series, SP5000 Smart Portal series products. An arbitrary code execution vulnerability exists in the implementation of Schneider Electric GP Pro EX version 4.07.000, which can be exploited by ...

Schneider Electric Pro-face GP-Pro EX

CVSS v3 7.2 ATTENTION: Public exploits are available. Vendor: Schneider Electric Equipment: Pro-face GP-Pro EX Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following versions of Pro-face GP-Pro EX software, an HMI management platform, are affected: GP Pro EX version...

Schneider Electric GP-Pro EX ParseAPI Heap Buffer Overflow

A heap buffer overflow vulnerability exists in Schneider Electric GP-Pro EX. This is due to input validation errors when parsing project files. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted project file...

Pro-face GP-Pro EX Security Bypass Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software. The Pro-face GP-Pro EX's FTP server uses hard-coded credentials, allowing remote attackers to exploit the vulnerability to access items in the device and obtain sensitive information...

Pro-face GP-Pro EX Denial of Service Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software from American Pro-face. A security vulnerability exists in Pro-face GP-Pro EX. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service read across boundaries...

CVE-2016-2292

Stack-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-2291

Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...

Out-of-bounds

Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...

Heap overflow

Heap-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7921

The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials...

CVE-2016-2290

CVE-2016-2290 is a heap-based buffer overflow affecting Pro-face GP-Pro EX and related editors (EX-ED, PFXEXEDV/EDLS/GRPLS) prior to version 4.05.000. The vulnerability allows remote execution of arbitrary code in the affected process due to a heap-buffer overflow, with the NVD reporting a high-s...

CVE-2015-7921

The CVE describes hard-coded credentials in the FTP server of Pro-face GP-Pro EX (affected models EX-ED, PFXEXEDV, PFXEXEDLS, PFXEXGRPLS) prior to version 4.05.000, enabling remote authentication bypass. Root cause: hard-coded credentials in the FTP service. Impact: unauthorized access to device ...

CVE-2015-7921

The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials...

Pro-face GP-Pro EX Authentication Bypass Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software from American Pro-face. The Pro-face GP-Pro EX has a security vulnerability due to the use of hard-coded certificates by the FTP server. A remote attacker could exploit the vulnerability to access items in the device...

Pro-face GP-Pro EX Stack Buffer Overflow Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software from American Pro-face. A stack buffer overflow vulnerability exists in Pro-face GP-Pro EX. A remote attacker can exploit this vulnerability to execute arbitrary code in the context of a process...

Pro-face GP-Pro EX Heap Buffer Overflow Vulnerability

Pro-face GP-Pro EX is a set of HMI screen editing and logic programming software from American Pro-face. A heap buffer overflow vulnerability exists in Pro-face GP-Pro EX. A remote attacker can exploit this vulnerability to execute arbitrary code in the context of a process...

CVE-2016-2291: Out-of-bounds Read

Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...