PT-2013-3925 · Schneider Electric · Trio J-Series License Free Ethernet Radio

Published 2013-08-28 · Updated 2013-08-29 · CVE-2013-2782

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Trio J-Series License Free Ethernet Radio versions 3.6.0 through 3.6.3

Description The issue allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of the AES encryption key, which is the same across different customers' installations.

Recommendations For versions 3.6.0 through 3.6.3, consider contacting Schneider Electric for guidance on obtaining a unique AES encryption key for each installation as a mitigation measure.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-2782

Affected Products

Trio J-Series License Free Ethernet Radio

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2782 · Security Note
• http://schneider-electric.com/download/ww/en/file/141141292-SEVD-2013-143-01.pdf · Vendor Advisory
• http://ics-cert.us-cert.gov/advisories/ICSA-13-234-01 · Note