Full Report
Schneider Electric has closed multiple vulnerabilities in U.motion Builder – a total of 16 vulnerabilities with different severity levels (CVSS v.3 base score of 4.3 to 10)
Analysis Summary
# Vulnerability: Multiple Severe Flaws in Schneider Electric U.motion Builder
## CVE Details
Schneider Electric addressed a total of **16 vulnerabilities**. Key identifiers include:
- **Critical & High Severity (Selected):**
- **CVE-2018-7784**: CVSS 10.0 (Critical) - OS Command Injection
- **CVE-2018-7785**: CVSS 10.0 (Critical) - OS Command Injection
- **CVE-2018-7786**: CVSS 10.0 (Critical) - OS Command Injection
- **CVE-2018-7787**: CVSS 10.0 (Critical) - OS Command Injection
- **CVE-2018-7789**: CVSS 9.8 (Critical) - Unrestricted File Upload
- **Medium Severity:**
- CVSS scores ranging from **4.3 to 7.5** (Addressing XSS, Information Disclosure, and PATH traversal flaws).
- **CWEs:** CWE-77 (Command Injection), CWE-434 (Unrestricted Upload), CWE-79 (XSS), CWE-22 (Path Traversal).
## Affected Systems
- **Products:** Schneider Electric U.motion Builder
- **Versions:** All versions prior to v1.3.4
- **Configurations:** Systems where the U.motion Builder web interface is accessible over the network.
## Vulnerability Description
The 16 vulnerabilities stem primarily from insufficient input validation within the U.motion Builder web management interface.
- **Command Injection:** Several endpoints failed to sanitize user inputs used in system-level commands, allowing an attacker to execute arbitrary OS commands with elevated privileges.
- **Unrestricted File Upload:** The system allowed the upload of files with dangerous extensions, which could be leveraged to achieve Remote Code Execution (RCE).
- **Broken Authentication/Authorization:** Flaws in how the application handles sessions and permissions allowed for unauthorized access to sensitive administrative functions.
## Exploitation
- **Status:** Vulnerabilities were disclosed following a coordinated research effort (independent researchers working with ICS-CERT). While no widespread exploitation "in the wild" was reported at the time of publication, PoCs were developed during the research phase.
- **Complexity:** Low (Many flaws can be exploited using simple HTTP requests).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Full access to system files and databases).
- **Integrity:** Total (Ability to modify building automation logic and system configurations).
- **Availability:** Total (Potential to crash service or brick the automation hardware).
## Remediation
### Patches
Schneider Electric released **U.motion Builder v1.3.4** to address all 16 identified vulnerabilities.
- **Action:** Users should update to version 1.3.4 or higher immediately.
### Workarounds
If patching is not immediately possible:
- **Network Isolation:** Ensure U.motion Builder devices are not accessible from the Internet.
- **Access Control:** Place the device behind a firewall and restrict access to authorized IP addresses only.
- **VPN:** Use secure VPN tunnels for remote access to the building automation network.
## Detection
- **Indicators of Compromise:** Unusual web server logs showing outbound system command syntax or unexpected file uploads to the `/var/www/` directory.
- **Detection methods:** Use vulnerability scanners with updated ICS-specific plugins to identify unpatched U.motion instances on the network.
## References
- **Schneider Electric Advisory:** hxxts[://]www[.]se[.]com/ww/en/download/document/SEVD-2018-095-01/
- **Kaspersky ICS CERT:** hxxts[://]ics-cert[.]kaspersky[.]com/publications/2018/04/11/multiple-vulnerabilities-closed-in-u-motion-builder-building-automation-solution/
- **ICS-CERT (CISA):** hxxts[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-18-095-03