CVE-2014-9188 - CVE House

Back to Database

Status published Critical CVE-2014-9188

Schneider Electric ProClima Command Injection

10 CVSS

Vulnerability Description

Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided by researchers.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9188

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

This vulnerability was reported to ZDI by security researchers Ariele Caltabiano, Andrea Micalizzi, and Brian Gorenc.

References

More from Schneider Electric

View All →

CWE-78: Improper Neutralization of Special Elements used in an OS...

CWE-78: Improper Neutralization of Special Elements used in an OS...

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege...

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site...

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists...

Affected Vendor

Schneider Electric

View all reports →

Affected Software

ProClima

Vulnerable Versions:

0

Timeline

Official Publish: December 27th, 2014

Last Modified: July 24th, 2025

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1105 Ingress Tool Transfer

Command and Control