PT-2019-5949 · Schneider Electric · Schneider Electric Software Update (Sesu) Sut Service

Published 2019-08-13 · Updated 2022-04-20 · CVE-2019-6834

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Software Update (SESU) SUT Service component versions V2.1.1 through V2.3.0

Description A Deserialization of Untrusted Data issue exists, which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM privileges when a malicious user is authenticated. This could be exploited by placing a malicious user to be authenticated, allowing the attacker to execute arbitrary code.

Recommendations For versions V2.1.1 through V2.3.0, update to a version outside of this range to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-03841

CVE-2019-6834

Affected Products

Schneider Electric Software Update (Sesu) Sut Service

References · 7

• https://osv.dev/vulnerability/CVE-2019-6834 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03841 · Security Note
• https://se.com/ww/en/download/document/SEVD-2019-225-06 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6834 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-06-SESU_SUT_Service.pdf&p_Doc_Ref=SEVD-2019-225-06 · Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-225-06-SESU_SUT_Service.pdf&p_Doc_Ref=SEVD-2019-225-06 · Note
• https://t.me/cibsecurity/40732 · Telegram Post