BLACKOUT MAP

Schneider Electric · U.motion Builder

CVE-2018-7841

Schneider Electric U.motion Builder SQL Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 72%
Share

What it is

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

CISA: A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.

What to do

The impacted product is end-of-life and should be disconnected if still in use.

Deadline for US federal agencies: May 6, 2022

Added to the CISA list
April 15, 2022
Published
May 22, 2019
Severity
Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
72% in the top 0.6% of all known vulnerabilities
Weakness
CWE-89
More details
NVD · CVE.org · CISA
All references (3)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.