A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user.

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user.

Schneider Electric is aware of a vulnerability in its OPC Factory Server (OFS). OPC Factory Server (OFS) is a standards compliant server application allowing open, real-time access to Schneider Electric automation and electrical distribution devices connected to Ethernet networks or fieldbuses. Failure to apply the remediation provided below may risk exposure of sensitive information, which could cause unauthorized read access to the file system running the OPC Factory Server (OFS).