PT-2017-18038 · Schneider Electric · Powerscada Anywhere+2

Published 2017-09-25 · Updated 2019-10-03 · CVE-2017-7972

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Schneider Electric's PowerSCADA Anywhere version 1.0 PowerSCADA Expert versions 8.1 through 8.2 Citect Anywhere version 1.0

Description A vulnerability exists that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes.

Recommendations For PowerSCADA Anywhere version 1.0, restrict access to the application to minimize the risk of exploitation. For PowerSCADA Expert versions 8.1 through 8.2, consider disabling remote access to PowerSCADA Anywhere until a fix is available. For Citect Anywhere version 1.0, avoid using the application for remote access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-7972

Affected Products

Citect Anywhere

Powerscada Anywhere

Powerscada Expert

References · 5

• http://schneider-electric.com/en/download/document/SEVD-2017-173-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7972 · Security Note
• https://citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere · Vendor Advisory
• http://securityfocus.com/bid/99913 · Note