PT-2013-1316 · Schneider Electric · Citectscada+2

Alexey Osipov + 2 · Published 2013-08-09 · Updated 2019-08-05 · CVE-2013-2796

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Vijeo Citect versions 7.20 and earlier Schneider Electric CitectSCADA versions 7.20 and earlier Schneider Electric PowerLogic SCADA versions 7.20 and earlier

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. The vulnerability is also associated with insufficient access restrictions to certain functions, which can be exploited by an attacker to achieve similar malicious outcomes.

Recommendations For Schneider Electric Vijeo Citect versions 7.20 and earlier, consider disabling the XML parsing functionality until a patch is available. For Schneider Electric CitectSCADA versions 7.20 and earlier, restrict access to the affected functions to minimize the risk of exploitation. For Schneider Electric PowerLogic SCADA versions 7.20 and earlier, avoid using the vulnerable XML document processing feature until the issue is resolved. As a temporary workaround, consider implementing additional access controls to limit the potential impact of the vulnerability.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-03752

CVE-2013-2796

Affected Products

Citectscada

Powerlogic Scada

Vijeo Citect

References · 6

• https://bdu.fstec.ru/vul/2019-03752 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2796 · Security Note
• http://citect.schneider-electric.com/cs-HF720SP459363 · Patch
• https://cxsecurity.com/cveshow/CVE-2013-2796 · Note
• https://us-cert.gov/ics/advisories/ICSA-13-217-02 · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02 · Note