CVE-2018-7239
High
Description
A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.
SeverityHigh
CVSS7.8
Exploit probability—
ProductSchneider-electric Somove
PublishedMar 9, 2018
First seenMar 9, 2018
How to fix
Update
- schneider-electric somove2.6.2 or later
- schneider-electric atv_lift_dtm12.7.0 or later
- schneider-electric atv12_dtm12.7.0 or later
- schneider-electric atv212_dtm12.7.0 or later
- schneider-electric atv31_dtm12.7.0 or later
- schneider-electric atv312_dtm12.7.0 or later
- schneider-electric atv32_dtm12.7.0 or later
- schneider-electric atv320_dtm1.1.6 or later
- schneider-electric atv340_dtm1.2.3 or later
- schneider-electric atv600_dtm1.8.0 or later
- schneider-electric atv61_dtm12.7.0 or later
- schneider-electric atv71_dtm12.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric somove | v < 2.6.2 | 2.6.2 |
| schneider-electric atv_lift_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv12_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv212_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv31_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv312_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv32_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv320_dtm | v < 1.1.6 | 1.1.6 |
| schneider-electric atv340_dtm | v < 1.2.3 | 1.2.3 |
| schneider-electric atv600_dtm | v < 1.8.0 | 1.8.0 |
| schneider-electric atv61_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv71_dtm | v < 12.7.0 | 12.7.0 |
| schneider-electric atv900_dtm | v < 1.3.5 | 1.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.