{
  "document": {
    "acknowledgments": [
      {
        "organization": "9sg Security Team",
        "summary": "reporting this vulnerability to NCCIC"
      },
      {
        "organization": "Trend Micro Zero Day Initiative (ZDI)",
        "summary": "reporting this vulnerability to NCCIC"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability could allow remote code execution through the opening of a specially crafted project file.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "France",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nNCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target this vulnerability.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-190-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-190-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-190-03 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-190-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://ics-cert.us-cert.gov/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Schneider Electric Zelio Soft 2",
    "tracking": {
      "current_release_date": "2019-07-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-19-190-03",
      "initial_release_date": "2019-07-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-07-09T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-19-190-03 Schneider Electric Zelio Soft 2"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 5.2",
                "product": {
                  "name": "Zelio Soft 2: Versions 5.2 and prior",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Zelio Soft 2"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric Software, LLC"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-6822",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability has been identified, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.CVE-2019-6822 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6822"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Schneider Electric reports that version 5.3 of the affected software mitigates the reported vulnerability. The new version can be downloaded from: https://www.schneider-electric.com/en/download/document/ZelioSoft2_V5_3/",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/ZelioSoft2_V5_3/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "9sg Security Team",
        "summary": "reporting this vulnerability to NCCIC"
      },
      {
        "organization": "Trend Micro Zero Day Initiative (ZDI)",
        "summary": "reporting this vulnerability to NCCIC"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability could allow remote code execution through the opening of a specially crafted project file.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "France",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nNCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target this vulnerability.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-190-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-190-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-190-03 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-190-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://ics-cert.us-cert.gov/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Schneider Electric Zelio Soft 2",
    "tracking": {
      "current_release_date": "2019-07-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-19-190-03",
      "initial_release_date": "2019-07-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-07-09T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-19-190-03 Schneider Electric Zelio Soft 2"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 5.2",
                "product": {
                  "name": "Zelio Soft 2: Versions 5.2 and prior",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Zelio Soft 2"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric Software, LLC"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-6822",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use after free vulnerability has been identified, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.CVE-2019-6822 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6822"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Schneider Electric reports that version 5.3 of the affected software mitigates the reported vulnerability. The new version can be downloaded from: https://www.schneider-electric.com/en/download/document/ZelioSoft2_V5_3/",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/ZelioSoft2_V5_3/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6822"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-15T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.",
  "id": "GHSA-p7v5-h443-4jcw",
  "modified": "2022-10-14T12:00:19Z",
  "published": "2022-05-24T16:50:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6822"
    },
    {
      "type": "WEB",
      "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01"
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-658"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/109100"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schneider-electric:zelio_soft_2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F717CDE-45B5-4D04-BDB7-65BC5CCBB17D",
              "versionEndIncluding": "5.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file."
    },
    {
      "lang": "es",
      "value": "Una CWE-416: Se presenta una vulnerabilidad de Uso de Memoria Previamente Liberada en Zelio Soft 2, versi\u00f3n V5.2 y anteriores, que podr\u00eda causar la ejecuci\u00f3n de c\u00f3digo remota al abrir un archivo de proyecto de Zelio Soft 2 especialmente dise\u00f1ado."
    }
  ],
  "id": "CVE-2019-6822",
  "lastModified": "2024-11-21T04:47:13.350",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-15T21:15:10.587",
  "references": [
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/109100"
    },
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01"
    },
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
    },
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/109100"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "cybersecurity@se.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2019-6822",
    "description": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.",
    "id": "GSD-2019-6822"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-6822"
      ],
      "details": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.",
      "id": "GSD-2019-6822",
      "modified": "2023-12-13T01:23:49.088166Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cybersecurity@schneider-electric.com",
        "ID": "CVE-2019-6822",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Zelio Soft 2 V5.2 and prior",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Zelio Soft 2 V5.2 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Zelio Soft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-416: Use After Free"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "109100",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/109100"
          },
          {
            "name": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/",
            "refsource": "MISC",
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/"
          },
          {
            "name": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01",
            "refsource": "MISC",
            "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01"
          },
          {
            "name": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03",
            "refsource": "MISC",
            "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:zelio_soft_2:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@schneider-electric.com",
          "ID": "CVE-2019-6822"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-416"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-01"
            },
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
            },
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-658/"
            },
            {
              "name": "109100",
              "refsource": "BID",
              "tags": [
                "Broken Link",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/109100"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-10-14T03:02Z",
      "publishedDate": "2019-07-15T21:15Z"
    }
  }
}

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "zelio soft 2",
        "scope": "lte",
        "trust": 1.8,
        "vendor": "schneider electric",
        "version": "5.2"
      },
      {
        "_id": null,
        "model": "zelio soft 2",
        "scope": null,
        "trust": 0.7,
        "vendor": "schneider electric",
        "version": null
      },
      {
        "_id": null,
        "model": "zelio soft",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "25.2"
      },
      {
        "_id": null,
        "model": "zelio soft",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "25.1"
      },
      {
        "_id": null,
        "model": "zelio soft",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "25.3"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "BID",
        "id": "109100"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:schneider-electric:zelio_soft_2:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "9sg Security Team working with Trend Micro Zero Day Initiative",
    "sources": [
      {
        "db": "BID",
        "id": "109100"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2019-6822",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 6.8,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2019-6822",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 1.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-6822",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 1.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2019-6822",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "REQUIRED",
            "vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-6822",
            "trust": 1.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2019-6822",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201907-521",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file. Zelio Soft 2 Contains a vulnerability in the use of freed memory.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric ZelioSoft 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of ZM2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. \nSchneider Electric Zelio Soft 2 version 5.2 and prior are vulnerable",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "BID",
        "id": "109100"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6822",
        "trust": 3.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-19-190-03",
        "trust": 2.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-19-658",
        "trust": 2.3
      },
      {
        "db": "BID",
        "id": "109100",
        "trust": 1.9
      },
      {
        "db": "SCHNEIDER",
        "id": "SEVD-2019-190-01",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-7895",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.2523",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "BID",
        "id": "109100"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "id": "VAR-201907-0067",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.42424244
  },
  "last_update_date": "2022-05-04T09:10:15.048000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "SEVD-2019-190-01",
        "trust": 0.8,
        "url": "https://www.schneider-electric.com/ww/en/download/document/sevd-2019-190-01"
      },
      {
        "title": "Schneider Electric has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
      },
      {
        "title": "Schneider Electric Zelio Soft 2 Remediation of resource management error vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=94654"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-416",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 3.4,
        "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-03"
      },
      {
        "trust": 2.2,
        "url": "https://www.securityfocus.com/bid/109100"
      },
      {
        "trust": 1.6,
        "url": "https://www.schneider-electric.com/ww/en/download/document/sevd-2019-190-01"
      },
      {
        "trust": 1.6,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-19-658/"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6822"
      },
      {
        "trust": 0.9,
        "url": "http://www.schneider-electric.com/products/ww/en/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6822"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.2523/"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658"
      },
      {
        "db": "BID",
        "id": "109100"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-19-658",
        "ident": null
      },
      {
        "db": "BID",
        "id": "109100",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6822",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2019-07-10T00:00:00",
        "db": "ZDI",
        "id": "ZDI-19-658",
        "ident": null
      },
      {
        "date": "2019-07-09T00:00:00",
        "db": "BID",
        "id": "109100",
        "ident": null
      },
      {
        "date": "2019-07-22T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-006480",
        "ident": null
      },
      {
        "date": "2019-07-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201907-521",
        "ident": null
      },
      {
        "date": "2019-07-15T21:15:00",
        "db": "NVD",
        "id": "CVE-2019-6822",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2019-07-10T00:00:00",
        "db": "ZDI",
        "id": "ZDI-19-658",
        "ident": null
      },
      {
        "date": "2019-07-09T00:00:00",
        "db": "BID",
        "id": "109100",
        "ident": null
      },
      {
        "date": "2019-08-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-006480",
        "ident": null
      },
      {
        "date": "2019-07-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201907-521",
        "ident": null
      },
      {
        "date": "2019-07-22T20:15:00",
        "db": "NVD",
        "id": "CVE-2019-6822",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Zelio Soft 2 Uses freed memory vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-006480"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201907-521"
      }
    ],
    "trust": 0.6
  }
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SCADAPack 300 E et 500 E series RTU (312E, 313E, 314E, 330E, 333E, 337E, 350E, 530E, 535E)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 57x RTU (570, 575)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 300 series RTU (314, 330, 334, 350)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 versions ant\u00e9rieures \u00e0 V2.70",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.90",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum versions ant\u00e9rieures \u00e0 V3.12",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Interactive Graphical SCADA System (IGSS) versions ant\u00e9rieures \u00e0 13.0.0.19140",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.01",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Ethernet Module BMENOC0301 versions ant\u00e9rieures \u00e0 V2.16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 versions ant\u00e9rieures \u00e0 V3.01",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Interactive Graphical SCADA System (IGSS) versions 14.x ant\u00e9rieures \u00e0 14.0.0.19120",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M221",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Zelio Soft 2 versions ant\u00e9rieures \u00e0 v5.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium versions ant\u00e9rieures \u00e0 V3.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 32 RTU",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Control Expert versions ant\u00e9rieures \u00e0 V14.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Momentum M1E 171CBU98090Modicon Momentum M1E 171CBU98091",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-6028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
    },
    {
      "name": "CVE-2018-7846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7846"
    },
    {
      "name": "CVE-2019-6822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6822"
    },
    {
      "name": "CVE-2018-7842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7842"
    },
    {
      "name": "CVE-2018-7849",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7849"
    },
    {
      "name": "CVE-2018-7838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7838"
    },
    {
      "name": "CVE-2019-6827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6827"
    },
    {
      "name": "CVE-2018-7854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7854"
    },
    {
      "name": "CVE-2018-7844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7844"
    },
    {
      "name": "CVE-2018-7847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7847"
    },
    {
      "name": "CVE-2019-6808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6808"
    },
    {
      "name": "CVE-2018-7850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7850"
    },
    {
      "name": "CVE-2018-7856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7856"
    },
    {
      "name": "CVE-2018-7845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7845"
    },
    {
      "name": "CVE-2018-7857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7857"
    },
    {
      "name": "CVE-2019-6807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6807"
    },
    {
      "name": "CVE-2019-6819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6819"
    },
    {
      "name": "CVE-2019-6806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6806"
    },
    {
      "name": "CVE-2018-7853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7853"
    },
    {
      "name": "CVE-2018-7843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7843"
    },
    {
      "name": "CVE-2018-7848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7848"
    }
  ],
  "initial_release_date": "2019-07-09T00:00:00",
  "last_revision_date": "2019-07-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-312",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-07-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-05 du 02 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05-Modicon+Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-01 du 09 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-01-Zelio-Soft-2.pdf\u0026p_Doc_Ref=SEVD-2019-190-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-065-01 du 09 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2017-065-01-Modicon-SCADAPack-V2.0.pdf\u0026p_Doc_Ref=SEVD-2017-065-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-11 du 09 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-11-Modicon-Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-11"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-02 du 09 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-02-IGSS.pdf\u0026p_Doc_Ref=SEVD-2019-190-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-03 du 09 juillet 2019",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-03-Modicon-M580-Controller.pdf\u0026p_Doc_Ref=SEVD-2019-190-03"
    }
  ]
}