Multiple Emerson Process Management RTUs CVE-2013-0689 Arbitrary File Upload Vulnerability

Bugtraq ID:	62666
Class:	Unknown
CVE:	CVE-2013-0689
Remote:	Yes
Local:	No
Published:	Sep 26 2013 12:00AM
Updated:	Dec 24 2014 12:55AM
Credit:	Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation
Vulnerable:
Not Vulnerable:

Multiple Emerson Process Management RTUs CVE-2013-0689 Arbitrary File Upload Vulnerability

Multiple Emerson Process Management RTUs including ROC800, DL8000, and ROC800L are prone to a vulnerability that lets attackers upload arbitrary files.

An attacker may leverage this issue to upload arbitrary files to the affected device; this can result in arbitrary code execution within the context of the vulnerable application.

The following products are affected:

ROC800 3.50 and prior
DL8000 2.30 and prior
ROC800L 1.20 and prior

Multiple Emerson Process Management RTUs CVE-2013-0689 Arbitrary File Upload Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Emerson Process Management RTUs CVE-2013-0689 Arbitrary File Upload Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Emerson Process Management RTUs CVE-2013-0689 Arbitrary File Upload Vulnerability

References:

• Emerson Electric Co Homepage (Emerson Electric Co)