PT-2017-3115 · Schneider Electric · Intouch Machine Edition+1

Publicado 2017-09-21 · Atualizado 2019-10-09 · CVE-2017-13997

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions 8.0 SP2 and earlier Schneider Electric InTouch Machine Edition versions 8.0 SP2 and earlier

Description A Missing Authentication for Critical Function issue allows a remote entity to bypass server authentication and execute arbitrary commands with high privileges, potentially leading to complete server compromise. The issue is related to the authentication procedure for HMI clients in the affected systems.

Recommendations For Schneider Electric InduSoft Web Studio versions 8.0 SP2 and earlier, update to a version later than 8.0 SP2 to resolve the issue. For Schneider Electric InTouch Machine Edition versions 8.0 SP2 and earlier, update to a version later than 8.0 SP2 to resolve the issue. As a temporary workaround, consider restricting access to the script execution functionality on the server to minimize the risk of exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2017-02513

CVE-2017-13997

Produtos afetados

Intouch Machine Edition

Indusoft Web Studio

Referências · 5

• https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01 · Nota
• http://securityfocus.com/bid/100952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-13997 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-13997 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02513 · Nota de Segurança