Schneider Electric SoMachine HVAC ActiveX Control Information Disclosure Vulnerability

EIP-50a1e402

An information disclosure vulnerability exists in Schneider Electric SoMachine HVAC due to a method in the ‘AxEditGrid3.ocx’ ActiveX control leaking a heap address of an ActiveX object. An attacker can entice a user to open a specially crafted web page to leak Internet Explorer process memory information.

Vulnerability Identifiers

• Exodus Intelligence: EIP-50a1e402
• MITRE: CVE-2022-2988

Vulnerability Metrics

• CVSSv2 Score: 5.0

Vendor References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-01_EcoStruxure_Machine_Expert_Machine_HVAC_Security_Notification.pdf&_ga=2.237030793.800437841.1673357607-1745106389

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 10th, 2021
• Disclosed to public: January 12th, 2023

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program (RSP).