SQL injection in U.motion Builder software version 1.3.4
Priority CRITICAL 100Exploited in the wildCWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.
Summary
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Why it matters now
Exploitation Active In CISA KEV since 2022-04-15CISA due date 2022-05-06
EPSS 0.72486 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| U.motion | U.motion Builder software version 1.3.4 | U.motion Builder software version 1.3.4 | — | No fix listed | CNA |
- U.motion Builder software version 1.3.4 VendorU.motion Affected U.motion Builder software version 1.3.4 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:* | 1.3.4 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-04-15 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-7841
- 2026-10-03 Alias added: GHSA-cwjr-6hc3-vpjm
References
Exploit 2
More Schneider Electric U.motion Builder vulnerabilities
- TI-2018-05619 Improper input validation in Schneider Electric U.Motion CVSS 3.0HIGH 8.8
- TI-2017-05577 Path traversal in Schneider Electric U.Motion CVSS 3.0CRITICAL 9.8
- TI-2018-05627 Command injection in Schneider Electric U.motion Builder CVSS 3.0CRITICAL 9.8
- TI-2017-07322 Hard-coded credentials in Schneider Electric U.Motion CVSS 3.0CRITICAL 9.8
- TI-2017-05576 SQL injection in Schneider Electric U.Motion CVSS 3.0CRITICAL 9.8
- TI-2018-05608 SQL injection in Schneider Electric U.Motion CVSS 3.0HIGH 8.8
Sources
- CVE-2018-7841 · CVE Program
- CVE-2018-7841 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-cwjr-6hc3-vpjm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences