Schneider Electric ProClima < 6.2 Multiple Vulnerabilities

Binary data 9037.prm...

Schneider Electric ProClima Application Detection

Binary data 9048.prm...

Furuno Voyage Data Recorder (VDR) moduleserv firmware update utility fails to properly sanitize user-provided input

Overview Furuno Voyage Data Recorder VDR VR-3000/VR-3000S and VR-7000 moduleserv firmware update utility fails to properly sanitize user-provided input and is vulnerable to arbitrary command execution with root privileges. Description According to the Furuno VDR product page, the VDR "records all...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, that was published March 26, 2015, to the NCCIC/ICS-CERT web site. Gleb Gritsai, Ilya Karpov, and Kirill Nesterov o...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities

OVERVIEW Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and independent researcher Alisa Esage Shevchenko have identified vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patch...

CVE-2015-7937

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data...

Stack overflow

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data...

CVE-2015-7937

Schneider Electric Modicon M340 PLC BMXNOx/BMXPx devices running the GoAhead Web Server are affected by CVE-2015-7937: a stack-based buffer overflow triggered by a long password in HTTP Basic Authentication data, enabling remote code execution. Evidence from multiple sources (NVD entry, ICS-CERT ...

CVE-2015-7937

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data...

Schneider Electric Patches Buffer Overflow in PLC Line

Automation and energy management company Schneider Electric patched a vulnerability in a product line this week that was leaving a handful of programmable automation controllers at risk of being hacked. Thirteen different builds of the Modicon M340 PLC are affected by the vulnerability, a buffer...

Schneider Electric ProClima Denial of Service Vulnerability

Schneider Electric ProClima is a thermal calculation software from Schneider Electric France. A denial of service vulnerability exists in Schneider Electric ProClima versions prior to 6.2. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted integer valu...

CVE-2015-8561

The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted integer value to the 1 AttachToSS, 2 CopyAll, 3 CopyRange, 4 CopyRangeEx, or 5 SwapTable method, a...

CVE-2015-7918

Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the 1 Attach, 2 DefinedName, 3 DefinedNameLocal, 4 ODBCPrepareEx, 5 ObjCreatePolygon, 6 SetTabbedTextEx, or 7 SetValidationRule...

CVE-2015-7918

Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the 1 Attach, 2 DefinedName, 3 DefinedNameLocal, 4 ODBCPrepareEx, 5 ObjCreatePolygon, 6 SetTabbedTextEx, or 7 SetValidationRule...

Memory corruption

The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted integer value to the 1 AttachToSS, 2 CopyAll, 3 CopyRange, 4 CopyRangeEx, or 5 SwapTable method, a...

Buffer overflow

Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the 1 Attach, 2 DefinedName, 3 DefinedNameLocal, 4 ODBCPrepareEx, 5 ObjCreatePolygon, 6 SetTabbedTextEx, or 7 SetValidationRule...

CVE-2015-8561

The connected sources confirm CVE-2015-8561 affects Schneider Electric ProClima’s F1BookView ActiveX control (F1 Bookview) in versions before 6.2. The vulnerability is described as a memory corruption issue that could allow remote code execution or a denial of service when a crafted integer is su...

CVE-2015-8561

The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted integer value to the 1 AttachToSS, 2 CopyAll, 3 CopyRange, 4 CopyRangeEx, or 5 SwapTable method, a...

CVE-2015-7918

The F1BookView ActiveX control in Schneider Electric ProClima before 6.2 contains multiple buffer overflows that can be triggered via the methods Attach, DefinedName, DefinedNameLocal, ODBCPrepareEx, ObjCreatePolygon, SetTabbedTextEx, and SetValidationRule, enabling remote code execution. This vu...

CVE-2015-7918

Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the 1 Attach, 2 DefinedName, 3 DefinedNameLocal, 4 ODBCPrepareEx, 5 ObjCreatePolygon, 6 SetTabbedTextEx, or 7 SetValidationRule...