CVE-2018-7239

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
Schneider Electric SE	SoMove	n/a

References

http://www.securityfocus.com/bid/103338Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-02Third Party Advisory, US Government Resource
https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/Vendor Advisory
http://www.securityfocus.com/bid/103338Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-02Third Party Advisory, US Government Resource
https://www.schneider-electric.com/en/download/document/SEVD-2018-060-01/Vendor Advisory

Timeline

Published: Mar 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-72408.8A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code CVE-2018-72419.8Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions CVE-2018-72429.8Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all CVE-2018-72439.8An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and M CVE-2018-72445.3An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and CVE-2018-72459.1An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and CVE-2018-72469.8A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse CVE-2018-72479.8An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer CVE-2018-72485.3An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user account CVE-2018-72497.0An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as CVE-2018-72505.5An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as CVE-2018-72519.8An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials