icsa-19-295-01
Vulnerability from csaf_cisa
Published
2019-10-22 00:00
Modified
2019-10-22 00:00
Summary
ICSA-19-295-01_Schneider Electric ProClima

Notes

CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Haojun Hou reported a vulnerability to CISA. Kushal Arvind Shah of Fortinet,Yongjun Liu of NSFOCUS security team, and Telus reported vulnerabilities to Schneider Electric.
Exploitability
No known public exploits specifically target these vulnerabilities.


To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Haojun Hou"
        ],
        "summary": "reporting a vulnerability to CISA"
      },
      {
        "names": [
          "Kushal Arvind Shah"
        ],
        "organization": "Fortinet",
        "summary": "reporting vulnerabilities to Schneider Electric"
      },
      {
        "names": [
          "Yongjun Liu"
        ],
        "organization": "NSFOCUS security team",
        "summary": "reporting vulnerabilities to Schneider Electric"
      },
      {
        "organization": "Telus",
        "summary": "reporting vulnerabilities to Schneider Electric"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "summary",
        "text": "Haojun Hou reported a vulnerability to CISA. Kushal Arvind Shah of Fortinet,Yongjun Liu of NSFOCUS security team, and Telus reported vulnerabilities to Schneider Electric.",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "CISAservicedesk@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-295-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-295-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-295-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-295-01"
      }
    ],
    "title": "ICSA-19-295-01_Schneider Electric ProClima",
    "tracking": {
      "current_release_date": "2019-10-22T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA USCert CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-19-295-01",
      "initial_release_date": "2019-10-22T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-10-22T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-19-295-01 Schneider Electric ProClima"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 8.0.0",
                "product": {
                  "name": "ProClima: all versions prior to 8.0.0",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ProClima"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric Software, LLC"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-6823",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A code injection vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.CVE-2019-6823 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Schneider Electric has released Version 8.0.0 of ProClima and recommends users upgrade to this version or newer. ",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/product-range-download/2560-proclima/#tabs-top"
        },
        {
          "category": "mitigation",
          "details": "For more information on these vulnerabilities and the associated upgrade, please see Schneider Electric\u0027s SEVD-2019-162-01",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-162-01/"
        },
        {
          "category": "mitigation",
          "details": "Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Physical controls should be in place so no unauthorized person has access to the ICS and safety controllers, peripheral equipment, or the ICS and safety networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All controllers should reside in locked cabinets and never be left in \u201cProgram\u201d mode.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All programming software should be kept in locked cabinets and should never be connected to any network other than the network for devices intended.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., should be scanned before use in the terminals or any node connected to these networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Laptops that have connected to any other network besides the intended network should never be allowed to connect to the safety or control networks without proper sanitation.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For further information related to cybersecurity in Schneider Electric\u0027s products, please visit the company\u0027s cybersecurity webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        },
        {
          "category": "mitigation",
          "details": "If you require additional support, Schneider Electric Industrial Cybersecurity Services team is available to help. Please visit",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2019-6823"
    },
    {
      "cve": "CVE-2019-6824",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A buffer error vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.CVE-2019-6824 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Schneider Electric has released Version 8.0.0 of ProClima and recommends users upgrade to this version or newer. ",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/product-range-download/2560-proclima/#tabs-top"
        },
        {
          "category": "mitigation",
          "details": "For more information on these vulnerabilities and the associated upgrade, please see Schneider Electric\u0027s SEVD-2019-162-01",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-162-01/"
        },
        {
          "category": "mitigation",
          "details": "Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Physical controls should be in place so no unauthorized person has access to the ICS and safety controllers, peripheral equipment, or the ICS and safety networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All controllers should reside in locked cabinets and never be left in \u201cProgram\u201d mode.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All programming software should be kept in locked cabinets and should never be connected to any network other than the network for devices intended.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., should be scanned before use in the terminals or any node connected to these networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Laptops that have connected to any other network besides the intended network should never be allowed to connect to the safety or control networks without proper sanitation.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For further information related to cybersecurity in Schneider Electric\u0027s products, please visit the company\u0027s cybersecurity webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        },
        {
          "category": "mitigation",
          "details": "If you require additional support, Schneider Electric Industrial Cybersecurity Services team is available to help. Please visit",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2019-6824"
    },
    {
      "cve": "CVE-2019-6825",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code.CVE-2019-6825 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Schneider Electric has released Version 8.0.0 of ProClima and recommends users upgrade to this version or newer. ",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/product-range-download/2560-proclima/#tabs-top"
        },
        {
          "category": "mitigation",
          "details": "For more information on these vulnerabilities and the associated upgrade, please see Schneider Electric\u0027s SEVD-2019-162-01",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-162-01/"
        },
        {
          "category": "mitigation",
          "details": "Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Physical controls should be in place so no unauthorized person has access to the ICS and safety controllers, peripheral equipment, or the ICS and safety networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All controllers should reside in locked cabinets and never be left in \u201cProgram\u201d mode.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All programming software should be kept in locked cabinets and should never be connected to any network other than the network for devices intended.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "All methods of mobile data exchange with the isolated network, such as CDs, USB drives, etc., should be scanned before use in the terminals or any node connected to these networks.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Laptops that have connected to any other network besides the intended network should never be allowed to connect to the safety or control networks without proper sanitation.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For further information related to cybersecurity in Schneider Electric\u0027s products, please visit the company\u0027s cybersecurity webpage",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page"
        },
        {
          "category": "mitigation",
          "details": "If you require additional support, Schneider Electric Industrial Cybersecurity Services team is available to help. Please visit",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.schneider-electric.com/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2019-6825"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.