First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2017-9957

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded password. An attacker can use this information to log into the system with high-privilege credentials.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Schneider Electric SE	U.Motion	U.motion Builder Versions 1.2.1 and prior.

References

Timeline

Published: Sep 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-99587.8An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an impro CVE-2017-99595.5A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in sess CVE-2017-99605.3An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the syste CVE-2017-99617.8A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. Malici CVE-2017-99627.5Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malform CVE-2017-99638.1A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistrib CVE-2017-99646.9A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communication CVE-2017-99655.8An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. Using CVE-2017-99667.1A privilege escalation vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. By replacing certain CVE-2017-99677.8A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration s CVE-2017-99685.9A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of CVE-2017-99696.7An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. Passwords are stored

CVE-2017-9957: Critical severity, CVSS 9.8 | Vulnix