CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product. The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediations provided below may risk local attacks from an authenticated user on the workstation running Foxboro DCS Core Control Services, which could result in loss of system functionality or unauthorized access to system functions.

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product. The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediations provided below may risk local attacks from an authenticated user on the workstation running Foxboro DCS Core Control Services, which could result in loss of system functionality or unauthorized access to system functions.