A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)

A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)

Schneider Electric is aware of multiple vulnerabilities in its C-Bus Toolkit and C-Gate server products. The C-Bus Toolkit product, which includes C-Gate Server, is an application you run on your personal computer to configure and commission C-Bus Installations. Failure to apply the remediations provided below may risk remote code execution attack, which could result in an attacker having remote access to the computer. November 2022 Update: The CWE for CVE-2021-22716 has been updated (marked in red). No additional action is required for customers who have already followed the remediation instructions provided below.