Skip to main content

Somachine CVE-2017-7966

HIGH
Uncontrolled Search Path Element (CWE-427)
2017-06-07 cybersecurity@se.com
RCE Schneider Electric Somachine
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 07, 2017 - 19:29 cve.org
HIGH 8.8

DescriptionCVE.org

A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL.

AnalysisAI

A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-427. A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL. Affected products include: Schneider-Electric Somachine.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Somachine

View all
CVE-2013-0662 CRITICAL POC
9.3 Apr 01

Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow
CVE-2020-7487 CRITICAL
9.8 Apr 22

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute
CVE-2014-9200 HIGH
7.5 Feb 01

Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachi
CVE-2020-7488 HIGH
7.5 Apr 22

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information t
CVE-2020-28220 MEDIUM
6.8 Dec 11

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258

Same weakness CWE-427 – Uncontrolled Search Path Element

View all
CVE-2017-6517 CRITICAL POC
9.8
CVE-2020-27955 CRITICAL POC
9.8
CVE-2024-48990 HIGH POC
7.8
CVE-2020-3433 HIGH POC
7.8
CVE-2022-2334 HIGH POC
7.2
CVE-2024-23054 CRITICAL POC
9.8
CVE-2023-31543 CRITICAL POC
9.8
CVE-2019-7653 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2017-7966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy