Vulnerability Description
Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh (aka Minimal Shell) protection mechanism.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Struxureware Building Operations Automation Server As | <= 1.7 |
| Schneider-Electric | Struxureware Building Operations Automation Server As Firmware | <= 1.7 |
| Schneider-Electric | Struxureware Building Operations Automation Server As-P | - |
| Schneider-Electric | Struxureware Building Operations Automation Server As-P Firmware | 1.7 |
Related Weaknesses (CWE)
References
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party AdvisoryUS Government Resource
- https://www.exploit-db.com/exploits/39522/Third Party AdvisoryVDB Entry
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-025-01Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01Third Party AdvisoryUS Government Resource
- https://www.exploit-db.com/exploits/39522/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-2278?
CVE-2016-2278 is a vulnerability with a CVSS score of 7.2 (HIGH). Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeati...
How severe is CVE-2016-2278?
CVE-2016-2278 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-2278?
Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Struxureware Building Operations Automation Server As, Schneider-Electric Struxureware Building Operations Automation Server As Firmware, Schneider-Electric Struxureware Building Operations Automation Server As-P, Schneider-Electric Struxureware Building Operations Automation Server As-P Firmware.