Lucene search

IcscertCVE-2017-13997

HistoryOct 03, 2017 - 1:29 a.m.

CVE-2017-13997

2017-10-0301:29:01

CWE-306

icscert

web.nvd.nist.gov

schneider electric

indusoft web studio

intouch machine edition

authentication

critical function

security vulnerability

cve-2017-13997

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

66.3%

JSON

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.

Affected configurations

Nvd

Node

schneider-electricwonderware_indusoft_web_studioRange≤8.0sp2

schneider-electricwonderware_intouchRange≤8.0sp2machine

VendorProductVersionCPE
schneider-electricwonderware_indusoft_web_studio*cpe:2.3:a:schneider-electric:wonderware_indusoft_web_studio:*:sp2:*:*:*:*:*:*
schneider-electricwonderware_intouch*cpe:2.3:a:schneider-electric:wonderware_intouch:*:sp2:*:*:machine:*:*:*

Vendor	Product	Version	CPE
schneider-electric	wonderware_indusoft_web_studio	*	cpe:2.3:a:schneider-electric:wonderware_indusoft_web_studio::sp2::::::*
schneider-electric	wonderware_intouch	*	cpe:2.3:a:schneider-electric:wonderware_intouch::sp2:::machine:::

CNA Affected

[
  {
    "product": "Schneider Electric InduSoft Web Studio, InTouch Machine Edition",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Schneider Electric InduSoft Web Studio, InTouch Machine Edition"
      }
    ]
  }
]

References

www.securityfocus.com/bid/100952

ics-cert.us-cert.gov/advisories/ICSA-17-264-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

66.3%

JSON

Related for CVE-2017-13997