A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product formerly known as Foxboro Evo Process Automation System and I/A Series. The DCS component impacted is the Control Core Services package. The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediations provided below may risk denial of service, privilege escalation, and kernel code execution, which could result in loss of system functionality or unauthorized access to system functions