9 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.012 Low
EPSS
Percentile
85.3%
**ATTENTION:**Remotely exploitable/low skill level to exploit.
Vendor: Schneider Electric
Equipment: StruxureOn Gateway
Vulnerability: Unrestricted Upload of File with Dangerous Type
Schneider Electric reports that the vulnerability affects the following versions of StruxureOn Gateway, a software management platform:
Successful exploitation of this vulnerability could allow a remote attacker to upload a malicious file to any directory on the device, which could lead to remote code execution.
Schneider Electric has released a new version of the software located at:
<https://struxureon.com/download-and-set-up-struxureon-gateway/>
For more information on these vulnerabilities and associated patch, please see Schneider Electricβs security notification SEVD-2018-039-01 on their website:
<https://www.schneider-electric.com/en/download/document/SEVD-2018-039-01/>
Schneider Electric reports that, in addition to upgrading to version 1.2, users should ensure they change the default passwords as this vulnerability requires authenticated access.
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the NCCIC Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT website.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
No known public exploits specifically target this vulnerability.
Uploading a zip file with modified metadata may allow remote code execution.
CVE-2017-9970 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Schneider Electric reported this vulnerability to NCCIC.
Critical Infrastructure Sectors: Critical Manufacturing, Energy
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9970
cwe.mitre.org/data/definitions/434.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
struxureon.com/download-and-set-up-struxureon-gateway/
twitter.com/CISAgov
twitter.com/intent/tweet?text=Schneider%20Electric%20StruxureOn%20Gateway+https://www.cisa.gov/news-events/ics-advisories/icsa-18-046-04
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-18-046-04&title=Schneider%20Electric%20StruxureOn%20Gateway
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-18-046-04
www.oig.dhs.gov/
www.schneider-electric.com/en/download/document/SEVD-2018-039-01/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-18-046-04
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Schneider%20Electric%20StruxureOn%20Gateway&body=www.cisa.gov/news-events/ics-advisories/icsa-18-046-04
9 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.012 Low
EPSS
Percentile
85.3%