CVE-2018-7841

Schneider Electric U.motion Builder suffered a SQL injection vulnerability that allowed unwanted code execution when improper characters were entered.

A SQL injection flaw in Schneider Electric U.motion Builder enabled unwanted code execution upon input of specific characters, exposing systems to potential data manipulation or unauthorized access. DIB organizations must ensure all industrial control and building management software is patched against known vulnerabilities, especially those listed in CISA's KEV catalog, to prevent similar exploits. This failure highlights the risk of relying on unpatched or poorly secured third-party software in critical infrastructure environments.

Shame score — The vulnerability was actively exploited (KEV) and allowed code execution, indicating a significant lapse in securing industrial software despite known risks.