CVE-2017-7966

{"id": "CVE-2017-7966", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-06-07T19:29:00.227", "references": [{"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "http://www.securityfocus.com/bid/98446", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cybersecurity@se.com"}, {"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/98446", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL."}, {"lang": "es", "value": "Una vulnerabilidad de secuestro de DLL en el software de programaci\u00f3n de SoMachine HVAC versi\u00f3n v2.1.0 de Schneider Electric, permite que un atacante remoto ejecute c\u00f3digo arbitrario en el sistema apuntado. La vulnerabilidad existe debido a la carga inapropiada de una DLL."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:somachine:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20558BC2-6E75-4CA5-81AD-27652926A17A"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}