CVE-2017-7969

CVE-2017-7969 is a CSRF vulnerability in the Secure Gateway component of Schneider Electric’s PowerSCADA Anywhere v1.0 (bundled with PowerSCADA Expert v8.1/8.2) and Citect Anywhere v1.0. The root cause is cross-site request forgery enabling multiple state-changing requests when a user is tricked ...

CVE-2017-7971

CVE-2017-7971 affects Schneider Electric PowerSCADA Anywhere v1.0 (used with PowerSCADA Expert v8.1/8.2) and Citect Anywhere v1.0. The issue is outdated TLS cipher suites and improper verification of peer SSL certificates, enabling potential man-in-the-middle or insecure communications. Public do...

CVE-2017-7970

CVE-2017-7970 affects Schneider Electric’s PowerSCADA Anywhere v1.0 (distributed with PowerSCADA Expert v8.1/8.2) and Citect Anywhere v1.0. The flaw allows an attacker, on an adjacent network, to specify arbitrary server target nodes in connection requests to the Secure Gateway and Server compone...

Schneider Electric PowerSCADA Anywhere/Citect Anywhere Information Disclosure Vulnerability

PowerSCADA Anywhere is SCADA and power monitoring software.Citect is industrial automation operation and monitoring software. An information disclosure vulnerability exists in the implementation of PowerSCADA Anywhere version 1.0 and Citect Anywhere version 1.0, which allows an attacker with a...

Schneider Electric PowerSCADA Anywhere/Citect Anywhere Certificate Validation Vulnerability

PowerSCADA Anywhere is SCADA and power monitoring software.Citect is industrial automation operation and monitoring software. A certificate validation vulnerability exists in PowerSCADA Anywhere version 1.0 and Citect Anywhere version 1.0. The vulnerability exists because the program uses expired...

Schneider Electric PowerSCADA Anywhere/Citect Anywhere Command Separator Improperity Vulnerability

PowerSCADA Anywhere is SCADA and power monitoring software.Citect is industrial automation operation and monitoring software. An improper command separator vulnerability exists in the implementation of PowerSCADA Anywhere 1.0 and Citect Anywhere version 1.0. An attacker in close network proximity...

Schneider Electric PowerSCADA Anywhere/Citect Anywhere Cross-Site Request Forgery Vulnerability

PowerSCADA Anywhere is SCADA and power monitoring software.Citect is industrial automation operation and monitoring software. A cross-site request forgery vulnerability exists in the gateway component of Schneider Electric PowerSCADA Anywhere version 1.0 and Citect Anywhere version 1.0, which can...

Schneider Electric PowerSCADA Anywhere and Citect Anywhere

CVSS v3 8.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: PowerSCADA Anywhere and Citect Anywhere Vulnerabilities: Information Exposure, Cross-Site Request Forgery, Improper Neutralization of Expression, Improper Validation of Certificate...

Schneider Electric Floating License Manager Vulnerability

OVERVIEW Schneider Electric had become aware of an “unquoted service path” vulnerability in the Schneider Electric Floating License Manager, produced a patchSchneider Electric Security Notification SEVD 2014-015-01v3,...

CVE-2013-2824

Schneider Electric StruxureWare SCADA Expert Vijeo Citect 7.40, Vijeo Citect 7.20 through 7.30SP1, CitectSCADA 7.20 through 7.30SP1, StruxureWare PowerSCADA Expert 7.30 through 7.30SR1, and PowerLogic SCADA 7.20 through 7.20SR1 do not properly handle exceptions, which allows remote attackers to...

CVE-2013-2824

CVE-2013-2824 affects Schneider Electric StruxureWare SCADA Expert Vijeo Citect (v7.40), Vijeo Citect (v7.20–7.30SP1), CitectSCADA (v7.20–7.30SP1), StruxureWare PowerSCADA Expert (v7.30–7.30SR1), and PowerLogic SCADA (v7.20–7.20SR1). The issue is an exception-handling flaw that allows remote atta...

Xxe

Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an...

CVE-2013-2796

This entry (CVE-2013-2796) describes an XML External Entity (XXE) vulnerability in Schneider Electric products: Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier. The underlying issue is improper restriction of XML entities, allowing a remote attac...

CVE-2013-2796

Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an...

Citect SCADA Device Detection

Binary data 6797.prm...

CVE-2013-3075

CVE-2013-3075 describes a heap-based buffer overflow in Mitsubishi MX Component Version 3 (ActUWzd.dll 1.0.0.1) distributed with CitectFacilities 7.10 and CitectSCADA 7.10r1. The overflow is triggered by oversized input (e.g., WzTitle) to a Mitsubishi MX ActiveX control, allowing remote code exec...

Citect SCADA ODBC Overflow Attempt (CVE-2008-2639)

...

CVE-2011-4035

Cross-site scripting XSS vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-3330

Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows local users, and...

Buffer overflow

Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows local users, and...