Lucene search

IcscertCVE-2017-14024

HistoryNov 13, 2017 - 8:29 p.m.

CVE-2017-14024

2017-11-1320:29:00

CWE-119

icscert

web.nvd.nist.gov

cve-2017-14024

schneider electric

indusoft web studio

intouch machine edition

buffer overflow

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.013

Percentile

86.3%

JSON

A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges.

Affected configurations

Nvd

Node

schneider-electricwonderware_indusoft_web_studioRange≤8.0sp2

schneider-electricwonderware_intouchRange≤8.0sp2machine

VendorProductVersionCPE
schneider-electricwonderware_indusoft_web_studio*cpe:2.3:a:schneider-electric:wonderware_indusoft_web_studio:*:sp2:*:*:*:*:*:*
schneider-electricwonderware_intouch*cpe:2.3:a:schneider-electric:wonderware_intouch:*:sp2:*:*:machine:*:*:*

Vendor	Product	Version	CPE
schneider-electric	wonderware_indusoft_web_studio	*	cpe:2.3:a:schneider-electric:wonderware_indusoft_web_studio::sp2::::::*
schneider-electric	wonderware_intouch	*	cpe:2.3:a:schneider-electric:wonderware_intouch::sp2:::machine:::

CNA Affected

[
  {
    "product": "Schneider Electric InduSoft Web Studio and InTouch Machine Edition",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Schneider Electric InduSoft Web Studio and InTouch Machine Edition"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101779

ics-cert.us-cert.gov/advisories/ICSA-17-313-02

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.013

Percentile

86.3%

JSON

Related for CVE-2017-14024