CVE-2018-7841: Schneider Electric U.motion Builder SQL injection allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCritical CVSS 9.8, unauthenticated network-reachable code execution, confirmed KEV listing and very high EPSS probability make this an urgent risk, compounded by the product being end-of-life with no patch path.

What it is

U.motion Builder version 1.3.4 contains a SQL injection flaw (CWE-89) that can lead to unwanted code execution when an improper set of characters is entered. It is remotely reachable with no authentication or user interaction and carries a critical CVSS score of 9.8, making it a serious risk for any deployment still running this end-of-life product.

Impact

An unauthenticated attacker can inject SQL and achieve code execution, gaining full control over confidentiality, integrity and availability of the affected system. This can lead to complete compromise of the host running U.motion Builder.

Attack surface

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with no privileges and no user interaction required. The description states the trigger is entering an improper set of characters, consistent with a remotely supplied input field.

Exploitation

CVE-2018-7841 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-15) and has an EPSS 30-day probability of 0.727 (99.4th percentile). Public exploit references exist on Packet Storm and the Full Disclosure mailing list, so active exploitation should be assumed.

What to do

• Disconnect or retire U.motion Builder 1.3.4, which is end-of-life per CISA's required action; do not rely on patching since no supported fix is indicated.
• If the product cannot be removed immediately, isolate it on a segmented network with strict firewall rules limiting access to trusted management hosts only.
• Monitor vendor advisory SEVD-2019-071-02 for any updated guidance and apply it if a supported replacement or fix becomes available.
• Inventory all instances of U.motion Builder across the environment and prioritize removal of any internet-facing or broadly reachable deployments.

Detection

• Search web and application logs for SQL metacharacters (quotes, comment sequences, UNION, stacked queries) in requests to U.motion Builder endpoints.
• Alert on unexpected child processes or command execution spawned by the U.motion Builder service, which would indicate successful code execution.
• Monitor network traffic to and from U.motion Builder hosts for anomalous outbound connections or unusual request patterns from external sources.
• Correlate IDS/IPS signatures for SQL injection and known exploit traffic against U.motion Builder hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.