CVE-2018-7777

CVE-2018-7777: vulnerability in Schneider Electric SE U.Motion

Published · Updated

Follow this CVE+ Monitor U.Motion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 32%
from disclosure to weapon580 days
Published on NVDJul 3
1st PoC+580d
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.
Affected products
Schneider Electric SE · U.Motion
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Schneider Electric SE U.Motion

In the same product, most dangerous first.

CVE-2017-7974—CVE-2017-7974EPSS 4.6%CVE-2018-7765—CVE-2018-7765EPSS 2.9%CVE-2017-9957—CVE-2017-9957EPSS 1.6%CVE-2017-7973—CVE-2017-7973EPSS 1.5%CVE-2018-7771—CVE-2018-7771EPSS 1.4%CVE-2018-7763—CVE-2018-7763EPSS 1.3%