PT-2019-2665 · Schneider Electric · Citectscada+2

Published 2019-05-31 · Updated 2020-10-02 · CVE-2019-10981

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vijeo Citect versions 7.30 through 7.40 CitectSCADA versions 7.30 through 7.40 PowerSCADA Expert (affected versions not specified)

Description The issue is related to insufficient protection of registration data, which may allow an attacker to gain access to user credentials. An authenticated local user may exploit this to access Citect user credentials.

Recommendations For Vijeo Citect versions 7.30 through 7.40, consider restricting access to the system until a fix is available. For CitectSCADA versions 7.30 through 7.40, restrict access to the system until a fix is available. For PowerSCADA Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2019-02552

CVE-2019-10981

Affected Products

Citectscada

Powerscada Expert

Vijeo Citect

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-10981 · Security Note
• https://bdu.fstec.ru/vul/2019-02552 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10981 · Vendor Advisory
• https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdf · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-150-01 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-162-02-PowerSCADA-Expert.pdf&p_Doc_Ref=SEVD-2019-162-02 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-162-02-PowerSCADA-Expert.pdf&p_Doc_Ref=SEVD-2019-162-02 · Note
• https://security.cse.iitk.ac.in/responsible-disclosure · Note
• http://securityfocus.com/bid/108543 · Note