CVE-2018-7841

What is U.motion Builder?

U.motion Builder is Schneider Electric's configuration software for its U.motion line of home and building automation controllers, used to design and deploy automation logic (lighting, HVAC, access control, and similar functions) in KNX-based smart building installations. Because U.motion Builder connects to and configures the automation controller's underlying database, injection flaws in the software have direct consequences for the building systems it manages.

Overview

CVE-2018-7841 is a SQL injection vulnerability in U.motion Builder that allows an attacker to manipulate backend database queries by submitting improperly sanitized input, potentially leading to unauthorized data access, data modification, or — as CISA's advisory notes — unwanted code execution. It carries a maximum CVSS score of 9.8 (Critical), reflecting that it requires no authentication or user interaction and can be triggered remotely over the network.

Technical Details

The root cause is CWE-89 (SQL Injection): U.motion Builder fails to properly validate or parameterize user-supplied input before incorporating it into SQL statements executed against its backend database. An attacker who can reach the affected interface can inject SQL metacharacters and additional query logic, and depending on the database engine's configuration and privileges, this can be escalated beyond simple data manipulation into arbitrary code execution on the host.

Discovery

The vulnerability was identified and addressed through Schneider Electric's ICS vulnerability disclosure process, with details published via CISA's ICS advisory channel.

Exploitation Context

CISA added CVE-2018-7841 to the KEV catalog in April 2022 based on confirmed exploitation. Critically, Schneider Electric has since designated the U.motion Builder product line as end-of-life, meaning no further vendor patches are available — CISA's required action for this entry is explicitly to disconnect the product from use rather than apply an update, reflecting that any remaining deployments are running unsupported, permanently vulnerable software.

Remediation

1. Identify any U.motion Builder installations and controllers still in operation — because the product is end-of-life, no patch will be issued.
2. Disconnect and decommission affected U.motion systems, replacing them with a currently supported building automation platform.
3. If immediate decommissioning is not possible, isolate the device fully from any network, including segmented building-management VLANs, and remove all remote/internet access.
4. Audit historical logs for any signs of unauthorized database queries or configuration changes indicating prior exploitation.
5. Treat any internet-reachable instance discovered during this audit as a priority incident, given the product's confirmed exploitation history and lack of ongoing vendor support.