Schneider Electric SoMachine 1.4 Service Pack 1

CPE Details

Schneider Electric SoMachine 1.4 Service Pack 1
schneider-electric
somachine
1.4
2017-04-13
11h43 +00:00
2022-01-31
18h42 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:schneider-electric:somachine:1.4:sp1:*:*:*:*:*:*

Informations

Vendor

schneider-electric

Product

somachine

Version

1.4

Update

sp1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-28220 2020-12-10 23h51 +00:00 A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a buffer overflow when the length of a file transferred to the webserver is not verified.
6.8
Medium
CVE-2020-7488 2020-04-22 16h51 +00:00 A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers.
7.5
High
CVE-2020-7487 2020-04-22 16h50 +00:00 A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers.
9.8
Critical
CVE-2017-7574 2017-04-06 19h00 +00:00 Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.
9.8
Critical
CVE-2013-0662 2014-03-28 18h00 +00:00 Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
9.3