CVE-2017-9961

A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. Malicious code installation requires an access to the computer. By placing a specific DLL/OCX file, an attacker is able to force the process to load arbitrary DLL and execute arbitrary code in the context of the process.

Score

CVSS 3.0 7.8 High

Status

Modified - cybersecurity@se.com

Published

2017-09-26

Last modified

2024-09-16

Affected products

• Pro-face Gp Pro Ex (Schneider-electric)
• Proface Gp-pro Ex (Schneider Electric Se)

References

• http://www.schneider-electric.com/en/download/document/SEVD-2017-195-01/
• http://www.securityfocus.com/bid/100114