PT-2017-18036 · Schneider Electric · Powerscada Anywhere+2

Publicado 2017-09-25 · Atualizado 2019-10-03 · CVE-2017-7970

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric PowerSCADA Anywhere version 1.0 Schneider Electric PowerSCADA Expert versions 8.1 through 8.2 Citect Anywhere version 1.0

Description A vulnerability exists that allows the ability to specify arbitrary server target nodes in connection requests to the Secure Gateway and Server components.

Recommendations For PowerSCADA Anywhere version 1.0, restrict access to the Secure Gateway and Server components to minimize the risk of exploitation. For PowerSCADA Expert versions 8.1 through 8.2, consider disabling the connection request feature to the Secure Gateway and Server components until a patch is available. For Citect Anywhere version 1.0, avoid using the arbitrary server target node specification in connection requests until the issue is resolved.

Correção

Identificadores relacionados

CVE-2017-7970

Produtos afetados

Citect Anywhere

Powerscada Anywhere

Powerscada Expert

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-7970 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7970 · Nota de Segurança
• http://securityfocus.com/bid/99913 · Nota
• http://schneider-electric.com/en/download/document/SEVD-2017-173-01 · Aviso do Fabricante
• https://citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere · Aviso do Fabricante