VULNERABILITY INTELLIGENCE

CVE-2017-7974

CVSS score9.8 CRITICAL

EPSS probability4.61%

CISA KEVNot currently listed

Published2017-09-26

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can execute arbitrary code and exfiltrate files.

Weakness classification

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

cybersecurity@se.com — Vendor Advisory
cybersecurity@se.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry