CVE-2017-7973observed exploitation

CVE-2017-7973: vulnerability in Schneider Electric SE U.Motion

Published · Updated

Follow this CVE+ Monitor U.Motion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendepss 1.5%
from disclosure to weapon
Published on NVDSep 25
VulnCheck+3083d
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.
Affected products
Schneider Electric SE · U.Motion
Related CVEs — Schneider Electric SE U.Motion

In the same product, most dangerous first.

CVE-2018-7777—CVE-2018-7777EPSS 31.8%CVE-2017-7974—CVE-2017-7974EPSS 4.6%CVE-2018-7765—CVE-2018-7765EPSS 2.9%CVE-2017-9957—CVE-2017-9957EPSS 1.6%CVE-2018-7771—CVE-2018-7771EPSS 1.4%CVE-2018-7763—CVE-2018-7763EPSS 1.3%