XML external entity injection in Schneider Electric SoMachine Basic
Priority LOW 36CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
Why it matters now
EPSS 0.0156 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | SoMachine Basic | SoMachine Basic prior to v1.6 SP1 | — | No fix listed | CNA |
- SoMachine Basic VendorSchneider Electric Affected SoMachine Basic prior to v1.6 SP1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:somachine_basic:*:*:*:*:*:*:*:* | up to 1.6 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:somachine_basic:*:*:*:*:*:*:*:* Versions up to 1.6 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7783
- 2026-10-03 Alias added: GHSA-cm3h-688r-2c3x
References
More Schneider Electric Somachine Basic vulnerabilities
- TI-2020-06012 Injection in SoMachine Basic EcoStruxure Machine Expert – Basic Modicon M100 Logic… CVSS 3.1CRITICAL 9.8
- TI-2018-05640 Insufficient verification of data authenticity in Schneider Electric Modicon M221, All… CVSS 3.1HIGH 8.2
- TI-2018-05659 Uncontrolled resource consumption in SoMachine Basic and Modicon M221, SoMachine Basic… CVSS 3.1HIGH 7.5
- TI-2018-05661 A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon… CVSS 3.1MEDIUM 5.3
- TI-2018-05660 Incorrect default permissions in SoMachine Basic and Modicon M221, SoMachine Basic, all… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2018-7783 · CVE Program
- CVE-2018-7783 · NVD
- FIRST EPSS
- GHSA-cm3h-688r-2c3x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences