var-201905-1065
Vulnerability from variot
In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials. Vijeo Citect and CitectSCADA Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA are a set of data acquisition and monitoring systems (SCADA) software from Schneider Electric. A security vulnerability exists in SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA that caused the program to fail to adequately protect the credentials. AVEVA Vijeo Citect and CitectSCADA are prone to an information-disclosure vulnerability. Attackers can exploit this issue to to obtain the sensitive information. The following products of AVEVA are vulnerable: Vijeo Citect 7.30 and 7.40 CitectSCADA 7.30 and 7.40. The following products and versions are affected: Schneider Electric AVEVA Vijeo Citect Version 7.30, Version 7.40; Schneider Electric AVEVA CitectSCADA Version 7.30, Version 7.40
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201905-1065", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "citectscada", "scope": "eq", "trust": 1.8, "vendor": "schneider electric", "version": "7.30" }, { "model": "citectscada", "scope": "eq", "trust": 1.8, "vendor": "schneider electric", "version": "7.40" }, { "model": "scada expert vijeo citect", "scope": "eq", "trust": 1.0, "vendor": "schneider electric", "version": "7.30" }, { "model": "scada expert vijeo citect", "scope": "eq", "trust": 1.0, "vendor": "schneider electric", "version": "7.40" }, { "model": "vijeo citect", "scope": "eq", "trust": 0.8, "vendor": "schneider electric", "version": "7.30" }, { "model": "vijeo citect", "scope": "eq", "trust": 0.8, "vendor": "schneider electric", "version": "7.40" }, { "model": "electric aveva vijeo citect", "scope": "eq", "trust": 0.6, "vendor": "schneider", "version": "7.30" }, { "model": "electric aveva vijeo citect", "scope": "eq", "trust": 0.6, "vendor": "schneider", "version": "7.40" }, { "model": "electric aveva citectscada", "scope": "eq", "trust": 0.6, "vendor": "schneider", "version": "7.30" }, { "model": "electric aveva citectscada", "scope": "eq", "trust": 0.6, "vendor": "schneider", "version": "7.40" }, { "model": "software vijeo citect", "scope": "eq", "trust": 0.3, "vendor": "aveva", "version": "7.40" }, { "model": "software vijeo citect", "scope": "eq", "trust": 0.3, "vendor": "aveva", "version": "7.30" }, { "model": "software citectscada", "scope": "eq", "trust": 0.3, "vendor": "aveva", "version": "7.40" }, { "model": "software citectscada", "scope": "eq", "trust": 0.3, "vendor": "aveva", "version": "7.30" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "citectscada", "version": "7.30" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "citectscada", "version": "7.40" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "scada expert vijeo citect", "version": "7.30" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "scada expert vijeo citect", "version": "7.40" } ], "sources": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "BID", "id": "108543" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:schneider_electric:citectscada", "vulnerable": true }, { "cpe22Uri": "cpe:/a:schneider_electric:vijeo_citect", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-004984" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "VAPT Team, C3i Center, and IIT Kanpur, and IIT Kanpur., and IIT Kanpur reported this vulnerability to AVEVA.", "sources": [ { "db": "CNNVD", "id": "CNNVD-201905-1129" } ], "trust": 0.6 }, "cve": "CVE-2019-10981", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 3.9, "id": "CVE-2019-10981", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 1.8, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "CNVD-2019-16225", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "IVD", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "version": "2.9 [IVD]" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 3.9, "id": "VHN-142582", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 0.1, "vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "id": "CVE-2019-10981", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2019-10981", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2019-10981", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2019-10981", "trust": 0.8, "value": "High" }, { "author": "CNVD", "id": "CNVD-2019-16225", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201905-1129", "trust": 0.6, "value": "HIGH" }, { "author": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1", "trust": 0.2, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-142582", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "VULHUB", "id": "VHN-142582" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials. Vijeo Citect and CitectSCADA Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA are a set of data acquisition and monitoring systems (SCADA) software from Schneider Electric. A security vulnerability exists in SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA that caused the program to fail to adequately protect the credentials. AVEVA Vijeo Citect and CitectSCADA are prone to an information-disclosure vulnerability. \nAttackers can exploit this issue to to obtain the sensitive information. \nThe following products of AVEVA are vulnerable:\nVijeo Citect 7.30 and 7.40\nCitectSCADA 7.30 and 7.40. The following products and versions are affected: Schneider Electric AVEVA Vijeo Citect Version 7.30, Version 7.40; Schneider Electric AVEVA CitectSCADA Version 7.30, Version 7.40", "sources": [ { "db": "NVD", "id": "CVE-2019-10981" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "BID", "id": "108543" }, { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "VULHUB", "id": "VHN-142582" } ], "trust": 2.7 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-10981", "trust": 3.6 }, { "db": "ICS CERT", "id": "ICSA-19-150-01", "trust": 3.4 }, { "db": "BID", "id": "108543", "trust": 2.0 }, { "db": "AUSCERT", "id": "ESB-2019.1954", "trust": 1.2 }, { "db": "CNNVD", "id": "CNNVD-201905-1129", "trust": 0.9 }, { "db": "CNVD", "id": "CNVD-2019-16225", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2019-004984", "trust": 0.8 }, { "db": "AUSCERT", "id": "ESB-2019.1954.2", "trust": 0.6 }, { "db": "IVD", "id": "BB0C5588-F2B1-49C3-BBF6-837CD34AC4D1", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-142582", "trust": 0.1 } ], "sources": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "VULHUB", "id": "VHN-142582" }, { "db": "BID", "id": "108543" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "id": "VAR-201905-1065", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "VULHUB", "id": "VHN-142582" } ], "trust": 1.6086080525000002 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 0.8 } ], "sources": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" } ] }, "last_update_date": "2024-11-23T22:51:45.175000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "AVEVA Security Advisory LFSEC00000136", "trust": 0.8, "url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdf" }, { "title": "SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA patches for insecure credential storage vulnerabilities", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/162721" }, { "title": "Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=93067" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-522", "trust": 1.1 }, { "problemtype": "CWE-255", "trust": 0.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-142582" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.4, "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-150-01" }, { "trust": 2.9, "url": "http://www.securityfocus.com/bid/108543" }, { "trust": 2.0, "url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/securityadvisory_lfsec136.pdf" }, { "trust": 1.7, "url": "https://security.cse.iitk.ac.in/responsible-disclosure" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10981" }, { "trust": 1.2, "url": "https://www.auscert.org.au/bulletins/esb-2019.1954/" }, { "trust": 0.9, "url": "https://www.aveva.com" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10981" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.1954.2/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "VULHUB", "id": "VHN-142582" }, { "db": "BID", "id": "108543" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "db": "CNVD", "id": "CNVD-2019-16225" }, { "db": "VULHUB", "id": "VHN-142582" }, { "db": "BID", "id": "108543" }, { "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "db": "NVD", "id": "CVE-2019-10981" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-06-02T00:00:00", "db": "IVD", "id": "bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1" }, { "date": "2019-06-02T00:00:00", "db": "CNVD", "id": "CNVD-2019-16225" }, { "date": "2019-05-31T00:00:00", "db": "VULHUB", "id": "VHN-142582" }, { "date": "2019-05-21T00:00:00", "db": "BID", "id": "108543" }, { "date": "2019-06-13T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "date": "2019-05-30T00:00:00", "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "date": "2019-05-31T21:29:02.267000", "db": "NVD", "id": "CVE-2019-10981" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-06-02T00:00:00", "db": "CNVD", "id": "CNVD-2019-16225" }, { "date": "2020-10-02T00:00:00", "db": "VULHUB", "id": "VHN-142582" }, { "date": "2019-05-21T00:00:00", "db": "BID", "id": "108543" }, { "date": "2019-06-13T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-004984" }, { "date": "2020-10-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201905-1129" }, { "date": "2024-11-21T04:20:17.440000", "db": "NVD", "id": "CVE-2019-10981" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "BID", "id": "108543" }, { "db": "CNNVD", "id": "CNNVD-201905-1129" } ], "trust": 0.9 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Vijeo Citect and CitectSCADA Vulnerabilities related to certificate and password management", "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-004984" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "trust management problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-201905-1129" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.