CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when application user opens a malicious Zelio Soft 2 project file.

CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when application user opens a malicious Zelio Soft 2 project file.

A Use After Free vulnerability exists that could cause arbitrary code execution, denial-of-service and loss of confidentiality & integrity if an application user opens a malicious Zelio Soft 2 project file. An Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application if a specially crafted project file is loaded by an application user.

Schneider Electric is aware of vulnerabilities in its Zelio Soft 2 product. The Zelio Soft 2 software for Zelio Logic smart relays (SR2/ SR3) enables programming in LADDER language or in function block diagram (FBD) language simulation, monitoring and supervision uploading and downloading of programs output of personalized files automatic compiling of programs. Failure to apply the fix provided below may risk remote code execution, which could result in resource exhaustion, information disclosure, or denial of service.