Schneider Electric StruxureOn Gateway

CVSS v3 7.2 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: StruxureOn Gateway Vulnerability: Unrestricted Upload of File with Dangerous Type AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following versions of...

CVE-2017-9970

A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully crafted metadata allows for the file to be uploaded to any directory on the host machine information which could lead to remote code execution...

CVE-2017-9970

Schneider Electric StruxureOn Gateway (versions up to 1.1.3) is affected by CVE-2017-9970. The vulnerability arises from unrestricted upload of a ZIP with crafted metadata, enabling remote code execution by placing a file in an arbitrary host directory. Public sources cite a CVSSv3 base score of ...