Schneider Electric U.motion Builder up to 1.2.1 Web Service hard-coded credentials

entryeditHistoryDiffjsonxmlCTI

A vulnerability classified as critical has been found in Schneider Electric U.motion Builder up to 1.2.1 (Automation Software). This affects an unknown part of the component Web Service. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10820033	01/14/2021	VulD...	cvss2_nvd_basescore	7.5	nist.gov	01/14/2021	accepted	90
10820032	01/14/2021	VulD...	person_name	rgod working with Trend Micro???s Zero Day Initiative.	securityfocus.com	01/14/2021	accepted	70
7140278	11/19/2019	VulD...	confirm_url	http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/	schneider-electric.com	11/19/2019	accepted	100
7140277	11/19/2019	VulD...	company_name	Zero Day Initiative		11/19/2019	accepted	100
7140235	11/19/2019	VulD...	discoverydate	1498694400		11/19/2019	accepted	100
7140297	09/26/2017	VulD...	cvss3_nvd_basescore	9.8	nist.gov	09/26/2017	accepted	90
7140296	09/26/2017	VulD...	0day_days	88		09/26/2017	accepted	90
7140295	09/26/2017	VulD...	cvss3_vuldb_rc	X		09/26/2017	accepted	90
7140294	09/26/2017	VulD...	cvss3_vuldb_rl	X		09/26/2017	accepted	90
7140293	09/26/2017	VulD...	cvss3_vuldb_e	X		09/26/2017	accepted	90
7140292	09/26/2017	VulD...	cvss2_vuldb_rc	ND		09/26/2017	accepted	90
7140291	09/26/2017	VulD...	cvss2_vuldb_rl	ND		09/26/2017	accepted	90
7140290	09/26/2017	VulD...	cvss2_vuldb_e	ND		09/26/2017	accepted	90
7140289	09/26/2017	VulD...	location	Website		09/26/2017	accepted	90
7140288	09/26/2017	VulD...	seealso	107142 107143 107144 107146 107147 107148		09/26/2017	accepted	100
7140287	09/26/2017	VulD...	securityfocus_title	Schneider Electric U.motion Builder Multiple Security Vulnerabilities	securityfocus.com	09/26/2017	accepted	100
7140286	09/26/2017	VulD...	securityfocus_class	Unknown	securityfocus.com	09/26/2017	accepted	100
7140285	09/26/2017	VulD...	securityfocus_date	1498780800 (06/30/2017)	securityfocus.com	09/26/2017	accepted	100
7140284	09/26/2017	VulD...	securityfocus	99344	securityfocus.com	09/26/2017	accepted	100
7140283	09/26/2017	VulD...	cve_nvd_summary	A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded password. An attacker can use this information to log into the system with high-privilege credentials.	mitre.org	09/26/2017	accepted	100