Unscored severity · published Feb 1, 2015
CVE-2014-9200
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6…
–
CVSS
5.4%
EPSS
No
On KEV
Description
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X80 Gateway DTM (MB TCP/SL), Advantys DTM for OTB, Advantys DTM for STB, KINOS DTM, SOLO DTM, and Xantrex DTMs allows remote attackers to execute arbitrary code via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Somachine · Schneider-electric
All versions, or not specified · source: NVD
SO
Somove · Schneider-electric
All versions, or not specified · source: NVD
SL
Somove Lite · Schneider-electric
All versions, or not specified · source: NVD
UP
Unity Pro · Schneider-electric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9200
www.securityfocus.com
http://www.securityfocus.com/bid/72335
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-009-01
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-15-027-02
Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-009-01
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-027-02
More from Somachine
9.8
CVE-2020-7487
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258…
9.8
CVE-2017-7574
Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability
8.8
CVE-2017-7966
A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system
7.5
CVE-2020-7488
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241,…
6.8
CVE-2020-28220
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and…