xArrow SCADA

🗓️ 17 Aug 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 90 Views

xArrow SCADA vulnerabilities in versions 7.2 and prior, allows unauthorized code execution. Critical Manufacturing, Energy, Water and Wastewater Systems affected worldwide. Mitigation: Disable web server, minimize network exposure, isolate control systems, use secure remote access

Reporter	Title	Published	Views	Family All 30
BDU FSTEC	The vulnerability of the “edate” parameter in the xhisalarm.htm component of the HMI/SCADA application xArrow allows attackers to perform cross-site scripting attacks.	21 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the “bdate” parameter in the xhisvalue.htm component of the HMI/SCADA application xArrow allows attackers to perform cross-site scripting attacks.	21 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of HMI/SCADA systems like xArrow arises from the possibility of running them with unverified registry keys with application-level privileges. This allows attackers to bypass existing security restrictions and enhance their privileges.	12 Nov 202100:00	–	bdu_fstec
Circl	CVE-2021-33001	16 May 202222:26	–	circl
Circl	CVE-2021-33021	16 May 202222:26	–	circl
Circl	CVE-2021-33025	16 May 202222:26	–	circl
CNNVD	xArrow SCADA 输入验证错误漏洞	17 Aug 202100:00	–	cnnvd
CNNVD	xArrow SCADA 跨站脚本漏洞	17 Aug 202100:00	–	cnnvd
CNNVD	xArrow SCADA 跨站脚本漏洞	17 Aug 202100:00	–	cnnvd
CVE	CVE-2021-33001	16 May 202217:52	–	cve

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-229-03.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-229-03
xarrow	www.xarrow.net/en/index.php/support/aboutus
us-cert	www.us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B

17 Aug 2021 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 24.6

CVSS 3.16.1 - 7.8

EPSS0.00291

SSVC