RCE in Schneider Electric Proclima

CVE-2014-9188

Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided by researchers.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.061 (92.7th percentile) — read the EPSS interpretation.

Affected products

Schneider Electric Proclima — versions 0
Schneider_electric Proclima

Weakness classification (CWE)

References

ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Patch, Vendor Advisory)
ics-cert@hq.dhs.gov
af854a3a-2127-422b-91ae-364da2661108 (Patch, Third Party Advisory, US Government Resource)