PT-2017-16352 · Schneider Electric · Wonderware Intouch Access Anywhere

Jan Bee + 1 · Published 2017-04-20 · Updated 2021-09-09 · CVE-2017-5158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware InTouch Access Anywhere versions prior to 11.5.2

Description An Information Exposure issue allows credentials to be exposed to external systems via specific URL parameters. This is possible because arbitrary destination addresses may be specified, potentially leading to unauthorized access.

Recommendations For versions prior to 11.5.2, update to a version newer than 11.5.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive URL parameters to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5158

Affected Products

Wonderware Intouch Access Anywhere

References · 5

• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5158 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5158 · Vendor Advisory
• http://securityfocus.com/bid/97256 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 · Note