EUVD-2018-19549

Malware in sbrugna...

EUVD-2018-19548

Malware in sbrugna...

EUVD-2018-19547

Malware in sbrugna...

EUVD-2018-19551

Malware in sbrugna...

Information disclosure

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

CVE-2018-7839 affects Schneider Electric IIoT Monitor 3.1.38 and is caused by a hard-coded cryptographic key in the AESEncryption component, leading to potential information disclosure. The risk context in the connected docs notes a cryptographic issue with confidentiality impact (C–H) and cites ...

Schneider Electric IIoT Monitor UpgradeMgmt upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is required to exploit this vulnerability but authentication can be easily bypassed. The specific flaw exists within the processing of the upload...

Schneider Electric IIoT Monitor EventMgmt getEvtPeriod XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the getEvtPeriod method of the EventMgmt servlet. Due to the...

Schneider Electric IIoT Monitor AccountMgmt forgotPwd XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the forgotPwd method of the AccountMgmt servlet. Due to the improp...

Schneider Electric IIoT Monitor downloadCSV Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within downloadCSV.jsp servlet. The issue results from the lack of...

Schneider Electric IIoT Monitor RuleMgmt addRule XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the addRule method of the RuleMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor RecoveryMgmt upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is required to exploit this vulnerability but authentication can be easily bypassed. The specific flaw exists within the processing of the upload...

Schneider Electric IIoT Monitor DeviceMapMgmt upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the upload method of the DeviceMapMgmt servlet. The...

Schneider Electric IIoT Monitor AccountMgmt Logout XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the Logout method of the AccountMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor EventMgmt addEvent XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the addEvent method of the EventMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor AccountMgmt Login XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the Login method of the AccountMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: IIoT Monitor --------- Begin Update A Part 1 of 2 -------- Vulnerabilities: Path Traversal, Unrestricted Upload of File with Dangerous Type, XXE, Cryptographic Issues...

IIoT Monitor Dangerous Type File Upload Vulnerability

Schneider Electric IIoT Monitor is an industrial IoT monitor from Schneider Electric France. A security vulnerability exists in Schneider Electric IIoT Monitor version 3.1.38. The vulnerability can be exploited by an attacker to upload and execute malicious files...