SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-723517348] Schneider Electric InduSoft Web Studio, InTouch Machine Edition

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2017-09-21OtherSchneider ElectricAaron Portnoy, formerly of Exodus Intelligence, discovered and reported this vulnerability to ICS-CERT. N/ACVE-2017-1399 N/AN/AN/A

Source

						
							
								
#
# Schneider Electric InduSoft Web Studio, InTouch Machine Edition
#


### VULNERABLE VENDOR
Schneider Electric


### VULNERABLE PRODUCT
InduSoft Web Studio, InTouch Machine Edition



### RESEARCHER
Aaron Portnoy, formerly of Exodus Intelligence, discovered and reported this vulnerability to ICS-CERT.



### AFFECTED PRODUCTS

Schneider Electric reports that the vulnerability affects the following InduSoft Web Studio products:

InduSoft Web Studio v8.0 SP2 or prior, and
InTouch Machine Edition v8.0 SP2 or prior.



### IMPACT

Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary commands with high privileges.



### VULNERABILITY OVERVIEW

MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions.
A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command.
The command is executed under high privileges and could lead to a complete compromise of the server.
CVE-2017-13997 has been assigned to this vulnerability.
A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)





### BACKGROUND

Critical Infrastructure Sectors: Critical Manufacturing, Energy, Healthcare and Public Health, Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Paris, France




### MITIGATION

Schneider Electric recommends users using InduSoft Web Studio v8.0 SP2 or prior should upgrade and apply InduSoft Web Studio v8.0 SP2 Patch 1 as soon as possible. This patch can be found on the Schneider Electric InduSoft web site at the following location:

http://download.indusoft.com/80.2.1/IWS80.2.1.zip


Schneider Electric recommends users using InTouch Machine Edition v8.0 SP2 or prior should upgrade and apply InTouch Machine Edition v8.0 SP2 Patch 1 as soon as possible. This patch can be found on Schneider Electric's Invensys web site at the following location (registration required):

https://gcsresource.invensys.com/tracking/ConfirmDownload.aspx?id=22453


For more information on this vulnerability and associated patch, please see InduSoft Security Bulletin LFSEC00000121 on the Schneider Electric cybersecurity web site:

http://software.schneider-electric.com/support/cyber-security-updates/