VULNERABILITY INTELLIGENCE

CVE-2017-9970

CVSS score7.2 HIGH

EPSS probability4.84%

CISA KEVNot currently listed

Published2018-02-12

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully crafted metadata allows for the file to be uploaded to any directory on the host machine information which could lead to remote code execution.

Weakness classification

CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references

cybersecurity@se.com — Third Party Advisory, VDB Entry
cybersecurity@se.com — Mitigation, Third Party Advisory, US Government Resource
cybersecurity@se.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory