Format String Vulnerability in U.motion KNX Server by Schneider Electric
CVE-2019-6840

9.8CRITICAL

Key Information:

Vendor
Schneider Electric
Status
U.motion Server
Vendor
CVE Published:
17 September 2019

Summary

A format string vulnerability exists in Schneider Electric's U.motion KNX Server, affecting multiple versions including MEG6501-0001, MEG6501-0002, and others. This security flaw allows attackers to craft malicious messages that, when sent to the server, can trigger the execution of arbitrary commands. This vulnerability can pose significant risks to users, highlighting the importance of applying security updates and best practices in the use of the affected products.

Affected Version(s)

U.motion Server MEG6501-0001 - U.motion KNX server

U.motion Server MEG6501-0002 - U.motion KNX Server Plus

U.motion Server MEG6260-0410 - U.motion KNX Server Plus

References

https://www.schneider-electric.com/ww/en/download/documen...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.