CVE-2017-7970 - Vulnerability Details - OpenCVE

A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components.

No CVSS v4.0

No CVSS v3.1

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Schneider-electric	Citect Anywhere Powerscada Anywhere Powerscada Expert

Configuration 1 [-]

AND

cpe:2.3:a:schneider-electric:powerscada_anywhere:1.0:*:*:*:*:*:*:*

OR	cpe:2.3:a:schneider-electric:powerscada_expert:8.1:::::::*
	cpe:2.3:a:schneider-electric:powerscada_expert:8.2:::::::*

Configuration 2 [-]

cpe:2.3:a:schneider-electric:citect_anywhere:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/
http://www.securityfocus.com/bid/99913
https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere

History

No history.

MITRE

Status: PUBLISHED

Assigner: schneider

Published: 2017-09-25T19:00:00Z

Updated: 2024-09-17T02:56:33.769Z

Reserved: 2017-04-19T00:00:00

Link: CVE-2017-7970

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-09-26T01:29:03.537

Modified: 2024-11-21T03:33:04.243

Link: CVE-2017-7970

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "PowerSCADA Anywhere", "vendor": "Schneider Electric SE", "versions": [{"status": "affected", "version": "Version 1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2"}]}, {"product": "Citect Anywhere", "vendor": "Schneider Electric SE", "versions": [{"status": "affected", "version": "version 1.0"}]}], "datePublic": "2017-06-22T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components."}], "problemTypes": [{"descriptions": [{"description": "Information Exposure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-26T09:57:01", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"name": "99913", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99913"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "DATE_PUBLIC": "2017-06-22T00:00:00", "ID": "CVE-2017-7970", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PowerSCADA Anywhere", "version": {"version_data": [{"version_value": "Version 1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2"}]}}, {"product_name": "Citect Anywhere", "version": {"version_data": [{"version_value": "version 1.0"}]}}]}, "vendor_name": "Schneider Electric SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Exposure"}]}]}, "references": {"reference_data": [{"name": "99913", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99913"}, {"name": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere", "refsource": "CONFIRM", "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"}, {"name": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/", "refsource": "CONFIRM", "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:19:29.484Z"}, "title": "CVE Program Container", "references": [{"name": "99913", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99913"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"}]}]}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2017-7970", "datePublished": "2017-09-25T19:00:00Z", "dateReserved": "2017-04-19T00:00:00", "dateUpdated": "2024-09-17T02:56:33.769Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:powerscada_anywhere:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "6445511E-70B8-4E03-A178-FFDBE02E1609", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:powerscada_expert:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "AE171A71-B1AF-471B-9D27-07D4491D05B3", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:powerscada_expert:8.2:*:*:*:*:*:*:*", "matchCriteriaId": "D2A3FA74-D201-41AA-BDA1-82816813AD11", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:citect_anywhere:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "5182F21D-1DF5-492A-9A3D-B913AC6B12F6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components."}, {"lang": "es", "value": "Existe una vulnerabilidad en la versi\u00f3n 1.0 de PowerSCADA Anywhere de Schneider Electric redistribuida con PowerSCADA Expert 8.1, PowerSCADA Expert 8.2 y Citect Anywhere 1.0 que permite que se especifiquen nodos de destino del servidor arbitrarios en peticiones de conexi\u00f3n a los componentes de Secure Gateway y Server."}], "id": "CVE-2017-7970", "lastModified": "2024-11-21T03:33:04.243", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-26T01:29:03.537", "references": [{"source": "cybersecurity@se.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"}, {"source": "cybersecurity@se.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99913"}, {"source": "cybersecurity@se.com", "tags": ["Issue Tracking", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99913"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mitigation", "Patch", "Vendor Advisory"], "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}