CVE-2015-1014

State: Published
Severity: Not scored
Published: Mar 25, 2019
Updated: Aug 6, 2024
Reserved: Jan 10, 2015

Description

A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.

Scores

The record has no CVSS score.

Weaknesses

CWE-427 DLL hijacking CWE-427

Affected Products

Product	Versions
OFS v3.5Schneider Electric	< v7.40 of SCADA Expert Vijeo Citect/CitectSCADAAffected < v7.30 of Vijeo Citect/CitectSCADAAffected < v7.20 of Vijeo Citect/CitectSCADA.Affected

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.