PT-2017-18038 · Schneider Electric · Powerscada Anywhere+2

Publicado 2017-09-25 · Atualizado 2019-10-03 · CVE-2017-7972

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Schneider Electric's PowerSCADA Anywhere version 1.0 PowerSCADA Expert versions 8.1 through 8.2 Citect Anywhere version 1.0

Description A vulnerability exists that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes.

Recommendations For PowerSCADA Anywhere version 1.0, restrict access to the application to minimize the risk of exploitation. For PowerSCADA Expert versions 8.1 through 8.2, consider disabling remote access to PowerSCADA Anywhere until a fix is available. For Citect Anywhere version 1.0, avoid using the application for remote access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2017-7972

Produtos afetados

Citect Anywhere

Powerscada Anywhere

Powerscada Expert

Referências · 5

• http://securityfocus.com/bid/99913 · Nota
• http://schneider-electric.com/en/download/document/SEVD-2017-173-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7972 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7972 · Nota de Segurança
• https://citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere · Aviso do Fabricante