CVE-2017-9970

CVE-2017-9970 is a remote code execution vulnerability affecting Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior, allowing an attacker to upload a specially crafted zip file with malicious metadata to an arbitrary directory. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating a high impact on confidentiality, integrity, and availability, and can be exploited remotely with high privileges and low attack complexity. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has received some community discussion and media coverage.