PT-2017-3115 · Schneider Electric · Intouch Machine Edition+1

Published 2017-09-21 · Updated 2019-10-09 · CVE-2017-13997

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions 8.0 SP2 and earlier Schneider Electric InTouch Machine Edition versions 8.0 SP2 and earlier

Description A Missing Authentication for Critical Function issue allows a remote entity to bypass server authentication and execute arbitrary commands with high privileges, potentially leading to complete server compromise. The issue is related to the authentication procedure for HMI clients in the affected systems.

Recommendations For Schneider Electric InduSoft Web Studio versions 8.0 SP2 and earlier, update to a version later than 8.0 SP2 to resolve the issue. For Schneider Electric InTouch Machine Edition versions 8.0 SP2 and earlier, update to a version later than 8.0 SP2 to resolve the issue. As a temporary workaround, consider restricting access to the script execution functionality on the server to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2017-02513

CVE-2017-13997

Affected Products

Intouch Machine Edition

Indusoft Web Studio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-13997 · Security Note
• https://osv.dev/vulnerability/CVE-2017-13997 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02513 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01 · Note
• http://securityfocus.com/bid/100952 · Note