CVE-2015-1014: 
Schneider Electric OPC Factory Server vulnerability analysis and mitigation

CVE-2015-1014 is a DLL hijacking vulnerability affecting Schneider Electric's OPC Factory Server (OFS) v3.5 when used with specific versions of SCADA Expert Vijeo Citect/CitectSCADA (v7.20, v7.30, and v7.40). The vulnerability was discovered in early 2015 by Ivan Sanchez from Nullcode Team (ICS-CERT).

The vulnerability is classified as an Uncontrolled Search Path Element (CWE-427) with a CVSS v3.0 base score of 7.3 (HIGH). The vulnerability requires local user access and user interaction to exploit. The attack vector involves loading a crafted DLL file in the system directory, which could lead to application crashes or arbitrary code execution with the same privileges as the vulnerable application (NVD).

If successfully exploited, this vulnerability could allow an attacker to crash the system or execute arbitrary code with the same privilege level as the application that utilizes the malicious DLL. The affected systems are deployed across many complex manufacturing processes and infrastructures in sectors including Commercial Facilities, Critical Manufacturing, Energy, Water and Wastewater Systems (ICS-CERT).

The vulnerability requires local access and cannot be exploited remotely. Successful exploitation requires user interaction to load specially crafted malformed DLL files. The difficulty of exploitation is considered moderate due to the need for social engineering to convince users to interact with malformed files (ICS-CERT).

Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version. The vendor has produced several new service patches that mitigate this vulnerability, which have been validated by the original researcher (ICS-CERT).