CVE-2014-9200: Schneider Electric Device Type Managers (DTMs) Stack-based Buffer Overflow

Published Feb 1, 2015

Updated

Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X80 Gateway DTM (MB TCP/SL), Advantys DTM for OTB, Advantys DTM for STB, KINOS DTM, SOLO DTM, and Xantrex DTMs allows remote attackers to execute arbitrary code via unspecified vectors.

Affected Software

4 affected components

Schneider-electric Somachine

Schneider-electric Somove

Schneider-electric Somove Lite

Schneider-electric Unity Pro

Remediation

Information

Schneider Electric has released a patch that resolves the vulnerability by removing the vulnerable DLL. Schneider Electric’s patch is available at the follow location: http://download.schneider-electric.com/files?p_Doc_Ref=FDT1 DLL Removal Kit. Schneider Electric’s security notice SEVD-2015-009-01 is available at the following location: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-009-01 .

Event History

Feb 1, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-9200?

CVE-2014-9200 has a high severity rating due to the potential for remote code execution via a stack-based buffer overflow.

How do I fix CVE-2014-9200?

To fix CVE-2014-9200, you should update to the latest versions of Schneider Electric Unity Pro, SoMachine, SoMove, and associated libraries.

What software is affected by CVE-2014-9200?

CVE-2014-9200 affects Schneider Electric Unity Pro, SoMachine, SoMove, and SoMove Lite, along with specific communication libraries.

What kind of vulnerability is CVE-2014-9200?

CVE-2014-9200 is categorized as a stack-based buffer overflow vulnerability.

Which specific versions are vulnerable as per CVE-2014-9200?

Versions earlier than Unity Pro, SoMachine, SoMove Lite 2.2.6, CANopen Communication Library 1.0.2, and EtherNet/IP Communication Library 1.0.0 are vulnerable according to CVE-2014-9200.