Schneider Electric PowerSCADA Anywhere and Citect Anywhere Multiple Security Vulnerabilities

Bugtraq ID:	99913
Class:	Unknown
CVE:	CVE-2017-7969 CVE-2017-7970 CVE-2017-7971 CVE-2017-7972
Remote:	Yes
Local:	No
Published:	Jul 20 2017 12:00AM
Updated:	Jul 20 2017 12:00AM
Credit:	Schneider Electric
Vulnerable:	Schneider-Electric PowerSCADA Expert 8.2 Schneider-Electric PowerSCADA Expert 8.1 Schneider-Electric PowerSCADA Anywhere 1.0 Schneider-Electric Citect Anywhere 1.0
Not Vulnerable:

Schneider Electric PowerSCADA Anywhere and Citect Anywhere Multiple Security Vulnerabilities

Schneider Electric PowerSCADA Anywhere and Citect Anywhere are prone to the following security vulnerabilities:

1. A cross-site request-forgery vulnerability
2. An information-disclosure vulnerability
3. Multiple security-bypass vulnerabilities

Exploiting these issues could allow an attacker to obtain sensitive information, bypass certain security restrictions, perform unauthorized actions, or gain access to the affected system.

Following products and versions are vulnerable:

PowerSCADA Anywhere 1.0 redistributed with PowerSCADA Expert 8.1 and PowerSCADA Expert 8.2
Citect Anywhere 1.0

Schneider Electric PowerSCADA Anywhere and Citect Anywhere Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Schneider Electric PowerSCADA Anywhere and Citect Anywhere Multiple Security Vulnerabilities

References:

• Schneider Electric Homepage (Schneider Electric)
  
• Advisory (ICSA-17-201-01) Schneider Electric PowerSCADA Anywhere and Citect Anyw (ICS-CERT)
  
• SEVD-2017-173-01 - Security Notification PowerSCADA Anywhere (Schneider Electric)