Actively exploited in the wild

Schneider Electric U.motion Builder SQL Injection Vulnerability

Schneider Electric - U.motion Builder · Listed in the CISA KEV since 2022-04-15. This indicates confirmed attacks in production environments.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

CVE-2018-7841

CriticalCVSS 9.8KEV

Published: 22/05/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Risk Assessment

An attacker could execute arbitrary code on the system, leading to application compromise. The risk is high as the vulnerability can be exploited remotely.

Recommendation

Update U.motion Builder to the latest patched version. It is also recommended to validate input and monitor for unusual SQL queries.

Other vulnerabilities in U.motion Builder

CVE-2017-7973Critical
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing unauthenticated users to execute arbitrary SQL commands against the underlying database.

Original NVD description (English source)

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.