What is the CVSS score of CVE-2018-7239?

CVE-2018-7239 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.9%.

Atv Lift Dtm CVE-2018-7239

HIGH

Untrusted Search Path (CWE-426)

2018-03-09 cybersecurity@se.com

Schneider Electric RCE Atv Lift Dtm Atv12 Dtm Atv212 Dtm Atv31 Dtm Atv312 Dtm Atv32 Dtm Atv320 Dtm Atv340 Dtm Atv600 Dtm Atv61 Dtm Atv71 Dtm Atv900 Dtm Somove

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 09, 2018 - 23:29 nvd

HIGH 7.8

DescriptionNVD

AnalysisAI

A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-426. A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code. Affected products include: Schneider-Electric Atv Lift Dtm, Schneider-Electric Atv12 Dtm, Schneider-Electric Atv212 Dtm, Schneider-Electric Atv31 Dtm, Schneider-Electric Atv312 Dtm. Version information: prior to 2.6.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.