A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the personal computer running C-Bus when using the File Command.

A?CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')?vulnerability exists?that could cause?a path traversal issue?when?using the File Command.

Schneider Electric's SpaceLogic C-Bus Toolkit product is vulnerable due to improper privilege management, which could cause remote code execution when the transfer command is used over the network. Schneider Electric's SpaceLogic C-Bus Toolkit product contains a path traversal vulnerability, which could cause tampering of files on the personal computer running C-Bus when using the File Command.

Schneider Electric is aware of multiple vulnerabilities in its SpaceLogic C-Bus Toolkit products. The SpaceLogic C-Bus Toolkit product is an application run on a personal computer to configure and commission C-Bus installations. Failure to apply the remediations provided below may risk remote code execution, which could result in tampering of the SpaceLogic C-Bus home automation system.