{"containers": {"cna": {"affected": [{"product": "SoMachine HVAC Programming Software", "vendor": "Schneider Electric SE", "versions": [{"status": "affected", "version": "v2.1.0 for Modicon M171/M172 Controllers"}]}], "datePublic": "2017-05-05T00:00:00", "descriptions": [{"lang": "en", "value": "A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL."}], "problemTypes": [{"descriptions": [{"description": "DLL Hijacking", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-08T09:57:01", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/"}, {"name": "98446", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/98446"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2017-7966", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SoMachine HVAC Programming Software", "version": {"version_data": [{"version_value": "v2.1.0 for Modicon M171/M172 Controllers"}]}}]}, "vendor_name": "Schneider Electric SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DLL Hijacking"}]}]}, "references": {"reference_data": [{"name": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/", "refsource": "CONFIRM", "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/"}, {"name": "98446", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98446"}]}}}}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2017-7966", "datePublished": "2017-06-07T19:00:00", "dateReserved": "2017-04-19T00:00:00", "dateUpdated": "2017-06-08T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:somachine:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "20558BC2-6E75-4CA5-81AD-27652926A17A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL."}, {"lang": "es", "value": "Una vulnerabilidad de secuestro de DLL en el software de programaci\u00f3n de SoMachine HVAC versi\u00f3n v2.1.0 de Schneider Electric, permite que un atacante remoto ejecute c\u00f3digo arbitrario en el sistema apuntado. La vulnerabilidad existe debido a la carga inapropiada de una DLL."}], "id": "CVE-2017-7966", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-07T19:29:00.227", "references": [{"source": "cybersecurity@se.com", "tags": ["Vendor Advisory"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/"}, {"source": "cybersecurity@se.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98446"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}