OTPulse
FeedAboutContact

Schneider Electric U.motion Builder

Act Now10ICS-CERT ICSA-18-163-01Jun 12, 2018
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

U.motion Builder contains input validation and command injection vulnerabilities (CWE-20, CWE-78, CWE-121, CWE-79) that allow remote code execution without authentication. An attacker can send a malicious request to the web interface to execute arbitrary commands on the system. All versions prior to 1.3.4 are affected.

What this means
What could happen
An attacker could remotely run code on the U.motion Builder system without any authentication, potentially gaining full control of the device and the building automation or energy management systems it manages.
Who's at risk
Energy utilities, building automation teams, and facility managers who use Schneider Electric U.motion Builder to manage HVAC systems, lighting, or other building/industrial systems. Any organization with versions earlier than 1.3.4 is at risk.
How it could be exploited
An attacker on the network sends a specially crafted request to the U.motion Builder interface (port 80/443). The vulnerable input validation (CWE-20) or command injection flaw (CWE-78) allows the attacker to break out of the intended application logic and execute arbitrary system commands. No authentication is required.
Prerequisites
  • Network access to the U.motion Builder web interface (typically port 80 or 443)
  • The device must be reachable from the attacker's location (if Internet-facing, from anywhere)
remotely exploitableno authentication requiredlow complexityhigh EPSS score (10.7%)critical CVSS (10)
Exploitability
High exploit probability (EPSS 10.7%)
Affected products (1)
ProductAffected VersionsFix Status
U.motion Builder:< 1.3.41.3.4
Remediation & Mitigation
0/4
Do now
0/2
HARDENINGEnsure U.motion Builder is not directly accessible from the Internet; place it behind a firewall or NAT on the internal network only
WORKAROUNDIf remote access is required, implement a VPN connection with access restricted to authorized users and systems
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade U.motion Builder to firmware version 1.3.4 or later
Long-term hardening
0/1
HARDENINGSegment the control system network from the business network using a firewall or air gap
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/dc9b8b09-2e06-4c5a-aa2b-98b5db388a26
Schneider Electric U.motion Builder | CVSS 10 - OTPulse