PT-2018-8543 · Schneider Electric · Powerscada Anywhere+2

Published 2018-02-12 · Updated 2019-04-23 · CVE-2017-9963

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PowerSCADA Anywhere version 1.0 PowerSCADA Expert versions 8.1 through 8.2 Citect Anywhere version 1.0

Description A cross-site request forgery issue exists in the Secure Gateway component, allowing for multiple state-changing requests. This type of attack requires social engineering to trick a legitimate user into accessing a malicious link or site containing the CSRF attack.

Recommendations For PowerSCADA Anywhere version 1.0, update the Secure Gateway component to prevent cross-site request forgery attacks. For PowerSCADA Expert versions 8.1 through 8.2, ensure the Secure Gateway component is updated to mitigate the risk of CSRF attacks. For Citect Anywhere version 1.0, consider restricting access to the Secure Gateway component until a fix is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-9963

Affected Products

Citect Anywhere

Powerscada Anywhere

Powerscada Expert

References · 4

• https://citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9963 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9963 · Vendor Advisory
• http://schneider-electric.com/en/download/document/SEVD-2017-173-01 · Note