var-201709-1100
Vulnerability from variot
A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes. Schneider Electric's PowerSCADA Anywhere and Citect Anywhere Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PowerSCADA Anywhere is SCADA and power monitoring software. Citect is an industrial automation operation and monitoring software. PowerSCADA Anywhere 1.0 and Citect Anywhere version 1.0 have bugs in the implementation of command delimiters. Attackers with close network locations can escape remote applications and start other processes. Schneider Electric PowerSCADA Anywhere and Citect Anywhere are prone to the following security vulnerabilities: 1. A cross-site request-forgery vulnerability 2. An information-disclosure vulnerability 3. Multiple security-bypass vulnerabilities Exploiting these issues could allow an attacker to obtain sensitive information, bypass certain security restrictions, perform unauthorized actions, or gain access to the affected system. Following products and versions are vulnerable: PowerSCADA Anywhere 1.0 redistributed with PowerSCADA Expert 8.1 and PowerSCADA Expert 8.2 Citect Anywhere 1.0
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-1100",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "powerscada anywhere",
"scope": "eq",
"trust": 2.7,
"vendor": "schneider electric",
"version": "1.0"
},
{
"model": "citect anywhere",
"scope": "eq",
"trust": 2.7,
"vendor": "schneider electric",
"version": "1.0"
},
{
"model": "electric citect anywhere",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.0"
},
{
"model": "electric powerscada anywhere",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.0"
},
{
"model": "powerscada expert",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "8.2"
},
{
"model": "powerscada expert",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "powerscada anywhere",
"version": "1.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "citect anywhere",
"version": "1.0"
}
],
"sources": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:schneider_electric:citect_anywhere",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:schneider_electric:powerscada_anywhere",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric",
"sources": [
{
"db": "BID",
"id": "99913"
}
],
"trust": 0.3
},
"cve": "CVE-2017-7972",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.1,
"id": "CVE-2017-7972",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2017-22846",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.1,
"id": "CVE-2017-7972",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-7972",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-7972",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-22846",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201704-896",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability exists in Schneider Electric\u0027s PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes. Schneider Electric\u0027s PowerSCADA Anywhere and Citect Anywhere Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PowerSCADA Anywhere is SCADA and power monitoring software. Citect is an industrial automation operation and monitoring software. PowerSCADA Anywhere 1.0 and Citect Anywhere version 1.0 have bugs in the implementation of command delimiters. Attackers with close network locations can escape remote applications and start other processes. Schneider Electric PowerSCADA Anywhere and Citect Anywhere are prone to the following security vulnerabilities:\n1. A cross-site request-forgery vulnerability\n2. An information-disclosure vulnerability\n3. Multiple security-bypass vulnerabilities\nExploiting these issues could allow an attacker to obtain sensitive information, bypass certain security restrictions, perform unauthorized actions, or gain access to the affected system. \nFollowing products and versions are vulnerable:\nPowerSCADA Anywhere 1.0 redistributed with PowerSCADA Expert 8.1 and PowerSCADA Expert 8.2\nCitect Anywhere 1.0",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7972"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-7972",
"trust": 3.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2017-173-01",
"trust": 1.9
},
{
"db": "BID",
"id": "99913",
"trust": 1.9
},
{
"db": "ICS CERT",
"id": "ICSA-17-201-01",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-22846",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375",
"trust": 0.8
},
{
"db": "IVD",
"id": "35CE550A-D7DA-4FFC-8C4C-9FF79A6F5F23",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"id": "VAR-201709-1100",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
}
],
"trust": 1.614484135
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
}
]
},
"last_update_date": "2024-11-23T22:12:40.223000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SEVD-2017-173-01",
"trust": 0.8,
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"
},
{
"title": "Security Notification - Citect Anywhere",
"trust": 0.8,
"url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"
},
{
"title": "Schneider Electric PowerSCADA Anywhere/Citect Anywhere Command Delimiter Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/100827"
},
{
"title": "Schneider Electric PowerSCADA Anywhere and Citect Anywhere Fixes for permission permissions and access control vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99736"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.schneider-electric.com/en/download/document/sevd-2017-173-01/"
},
{
"trust": 1.6,
"url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/99913"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7972"
},
{
"trust": 0.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-201-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7972"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "35ce550a-d7da-4ffc-8c4c-9ff79a6f5f23"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"date": "2017-07-20T00:00:00",
"db": "BID",
"id": "99913"
},
{
"date": "2017-10-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"date": "2017-04-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"date": "2017-09-26T01:29:03.617000",
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22846"
},
{
"date": "2017-07-20T00:00:00",
"db": "BID",
"id": "99913"
},
{
"date": "2017-10-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008375"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-896"
},
{
"date": "2024-11-21T03:33:04.503000",
"db": "NVD",
"id": "CVE-2017-7972"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric\u0027s PowerSCADA Anywhere and Citect Anywhere Vulnerabilities related to authorization, permissions, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008375"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201704-896"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…