Sign-up

ID

VAR-201304-0150


CVE

CVE-2013-0663


TITLE

Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability

Trust: 0.8

sources: IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials. The following versions are affected by this vulnerability: Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. The SESU tool used by several of these products is used to update software on Windows PC systems. Such as modifying the HTTP authentication credentials. Schneider Electric Products are prone to multiple security vulnerabilities. Successfully exploiting these issues allows remote attackers to execute arbitrary code or perform unauthorized actions in the context of the user's session; other attacks are also possible. Note: The denial-of-service vulnerability issue affecting Modicon M340 and the authentication-bypass issue affecting Maagelis XBT HMI were determined not to be vulnerabilities. The following Schneider Electric products are affected: BMX NOE 0110 Modicon M340. Schneider Electric software on customer PCs uses the SESU service as a communication mechanism to the Schneider Electric central update server, which can be used to receive software updates on a regular basis. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA52189 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52189/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52189 RELEASE DATE: 2013-02-14 DISCUSS ADVISORY: http://secunia.com/advisories/52189/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52189/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52189 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Schneider Electric Ethernet Modules, which can be exploited by malicious people to conduct cross-site request forgery attacks. The vulnerability is caused due to the modules allowing users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change credentials when a logged-in administrator visits a specially crafted web page. Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100 SOLUTION: No official solution is currently available. PROVIDED AND/OR DISCOVERED BY: The vendor credits Arthur Gervais. ORIGINAL ADVISORY: SEVD-2013-023-01: http://download.schneider-electric.com/files?L=en&p=&p_docId=&p_docId=&p_Reference=SEVD%202013-023-01&p_EnDocType=Technical%20paper&p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.51

sources: NVD: CVE-2013-0663 // JVNDB: JVNDB-2013-002146 // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02841 // BID: 57435 // IVD: 03f69634-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // VULHUB: VHN-60665 // PACKETSTORM: 120311

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: 03f69634-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02841

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon quantum plcscope:eqversion:140noe77101

Trust: 2.4

vendor:schneider electricmodel:modicon quantum plcscope:eqversion:140nwm10000

Trust: 2.4

vendor:schneider electricmodel:modicon m340scope:eqversion:bmxnoc0401

Trust: 1.6

vendor:schneider electricmodel:modicon premiumscope:eqversion:tsxety4103

Trust: 1.6

vendor:schneider electricmodel:modicon premiumscope:eqversion:tsxety5103

Trust: 1.6

vendor:schneider electricmodel:modicon m340scope:eqversion:bmxnoe011xx

Trust: 1.6

vendor:schneider electricmodel:modicon m340scope:eqversion:bmxnoe0100x

Trust: 1.6

vendor:schneider electricmodel:modicon premiumscope:eqversion:tsxwmy100

Trust: 1.6

vendor:schneider electricmodel:modicon quantum plcscope:eqversion:140noe77111

Trust: 1.6

vendor:schneider electricmodel:modicon m340 pacscope:eqversion:bmxnoc0401

Trust: 0.8

vendor:schneider electricmodel:modicon m340 pacscope:eqversion:bmxnoe0100x

Trust: 0.8

vendor:schneider electricmodel:modicon m340 pacscope:eqversion:bmxnoe011xx

Trust: 0.8

vendor:schneider electricmodel:modicon premium plcscope:eqversion:tsxety4103

Trust: 0.8

vendor:schneider electricmodel:modicon premium plcscope:eqversion:tsxety5103

Trust: 0.8

vendor:schneider electricmodel:modicon premium plcscope:eqversion:tsxwmy100

Trust: 0.8

vendor:schneider electricmodel:modicon quantum plcscope:eqversion:40noe77111

Trust: 0.8

vendor:schneidermodel:electric m340 series modulesscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum series modulesscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric premium series modulesscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric quantum 140noe77111scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric quantum 140noe77101scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric quantum 140nwm10000scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric m340 bmxnoc0401scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric m340 bmxnoe0100xscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric m340 bmxnoe011xxscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric premium tsxety4103scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric premium tsxety5103scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric premium tsxwmy100scope: - version: -

Trust: 0.6

vendor:modicon quantum plcmodel:140noe77101scope: - version: -

Trust: 0.2

vendor:modicon quantum plcmodel:140noe77111scope: - version: -

Trust: 0.2

vendor:modicon quantum plcmodel:140nwm10000scope: - version: -

Trust: 0.2

vendor:modicon m340model:bmxnoc0401scope: - version: -

Trust: 0.2

vendor:modicon m340model:bmxnoe011xxscope: - version: -

Trust: 0.2

vendor:modicon m340model:bmxnoe0100xscope: - version: -

Trust: 0.2

vendor:modicon premiummodel:tsxety4103scope: - version: -

Trust: 0.2

vendor:modicon premiummodel:tsxety5103scope: - version: -

Trust: 0.2

vendor:modicon premiummodel:tsxwmy100scope: - version: -

Trust: 0.2

vendor:schneidermodel:electric m340 series modules nullscope:eqversion:*

Trust: 0.2

vendor:schneidermodel:electric modicon quantum series modules nullscope:eqversion:*

Trust: 0.2

vendor:schneidermodel:electric premium series modules nullscope:eqversion:*

Trust: 0.2

sources: IVD: 03f69634-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02841 // JVNDB: JVNDB-2013-002146 // CNNVD: CNNVD-201301-366 // NVD: CVE-2013-0663

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-0663
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-0663
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2013-02841
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201301-366
value: MEDIUM

Trust: 0.6

IVD: 03f69634-2353-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d
value: LOW

Trust: 0.2

VULHUB: VHN-60665
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-0663
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-02841
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.8
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 03f69634-2353-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.8
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

VULHUB: VHN-60665
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 03f69634-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02841 // VULHUB: VHN-60665 // JVNDB: JVNDB-2013-002146 // CNNVD: CNNVD-201301-366 // NVD: CVE-2013-0663

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-60665 // JVNDB: JVNDB-2013-002146 // NVD: CVE-2013-0663

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201301-366

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201301-366

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-002146

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-60665

PATCH
title:Important Security Notification - M340, Quantum. and Premium Ethernet communication modulesurl:http://download.schneider-electric.com/files?p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf
Trust: 0.8
title:SEVD 2013-023-01url:http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/
Trust: 0.8
title:サポートurl:http://www.schneider-electric.co.jp/sites/japan/jp/support/contact/we-care.page
Trust: 0.8
title:トップページurl:http://www.schneider-electric.com/site/home/index.cfm/jp/
Trust: 0.8
title:Patch for multiple product cross-site request forgery vulnerabilities in Schneider Electricurl:https://www.cnvd.org.cn/patchInfo/show/33179
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-02841 // 
            
            
            
            JVNDB: JVNDB-2013-002146

EXTERNAL IDS
db:NVDid:CVE-2013-0663
Trust: 3.6
db:ICS CERTid:ICSA-13-077-01A
Trust: 3.4
db:SCHNEIDERid:SEVD-2013-023-01
Trust: 2.4
db:BIDid:57435
Trust: 1.5
db:EXPLOIT-DBid:44678
Trust: 1.1
db:CNNVDid:CNNVD-201301-366
Trust: 0.9
db:CNVDid:CNVD-2013-02841
Trust: 0.8
db:CNVDid:CNVD-2013-01138
Trust: 0.8
db:SECUNIAid:52189
Trust: 0.8
db:JVNDBid:JVNDB-2013-002146
Trust: 0.8
db:ICS CERTid:ICSA-13-077-01
Trust: 0.3
db:ICS CERTid:ICSA-13-077-01B
Trust: 0.3
db:ICS CERT ALERTid:ICS-ALERT-13-016-01
Trust: 0.3
db:ICS CERT ALERTid:ICS-ALERT-13-016-01A
Trust: 0.3
db:IVDid:03F69634-2353-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:8D5791DE-1F35-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:147715
Trust: 0.1
db:VULHUBid:VHN-60665
Trust: 0.1
db:PACKETSTORMid:120311
Trust: 0.1
sources:
            
            
            IVD: 03f69634-2353-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-01138 // 
            
            
            
            CNVD: CNVD-2013-02841 // 
            
            
            
            VULHUB: VHN-60665 // 
            
            
            
            BID: 57435 // 
            
            
            
            JVNDB: JVNDB-2013-002146 // 
            
            
            
            PACKETSTORM: 120311 // 
            
            
            
            CNNVD: CNNVD-201301-366 // 
            
            
            
            NVD: CVE-2013-0663

REFERENCES
url:http://ics-cert.us-cert.gov/pdf/icsa-13-077-01a.pdf
Trust: 3.4
url:http://www.schneider-electric.com/download/ww/en/file/36555639-sevd-2013-023-01.pdf/?filename=sevd-2013-023-01.pdf&reference=sevd-2013-023-01&doctype=technical-paper
Trust: 2.2
url:http://www.schneider-electric.com/download/ww/en/details/35081317-vulnerability-disclosure-for-quantum-premium-and-m340/
Trust: 1.7
url:https://www.exploit-db.com/exploits/44678/
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0663
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0663
Trust: 0.8
url:http://secunia.com/advisories/52189/
Trust: 0.7
url:http://www.securityfocus.com/bid/57435
Trust: 0.6
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
url:http://www.us-cert.gov/control_systems/pdf/ics-alert-13-016-01.pdf
Trust: 0.3
url:http://ics-cert.us-cert.gov/pdf/ics-alert-13-016-01a.pdf
Trust: 0.3
url:http://ics-cert.us-cert.gov/pdf/icsa-13-077-01.pdf
Trust: 0.3
url:http://ics-cert.us-cert.gov/advisories/icsa-13-077-01b
Trust: 0.3
url:http://www.schneider-electric.com/download/ww/en/file/36555639-sevd-2013-023-01.pdf/?filename=sevd-2013-023-01.pdf&reference=sevd-2013-023-01&doctype=technical-paper
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
Trust: 0.1
url:http://download.schneider-electric.com/files?l=en&p=&p_docid=&p_docid=&p_reference=sevd%202013-023-01&p_endoctype=technical%20paper&p_file_id=36555639&p_file_name=sevd-2013-023-01.pdf
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/52189/#comments
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-01138 // 
            
            
            
            CNVD: CNVD-2013-02841 // 
            
            
            
            VULHUB: VHN-60665 // 
            
            
            
            BID: 57435 // 
            
            
            
            JVNDB: JVNDB-2013-002146 // 
            
            
            
            PACKETSTORM: 120311 // 
            
            
            
            CNNVD: CNNVD-201301-366 // 
            
            
            
            NVD: CVE-2013-0663

CREDITS
Arthur Gervais
Trust: 0.9
sources:
            
            
            BID: 57435 // 
            
            
            
            CNNVD: CNNVD-201301-366

SOURCES
db:IVDid:03f69634-2353-11e6-abef-000c29c66e3d
db:IVDid:8d5791de-1f35-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-01138
db:CNVDid:CNVD-2013-02841
db:VULHUBid:VHN-60665
db:BIDid:57435
db:JVNDBid:JVNDB-2013-002146
db:PACKETSTORMid:120311
db:CNNVDid:CNNVD-201301-366
db:NVDid:CVE-2013-0663

LAST UPDATE DATE
2024-11-23T21:51:40.312000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-01138date:2013-05-28T00:00:00
db:CNVDid:CNVD-2013-02841date:2013-04-10T00:00:00
db:VULHUBid:VHN-60665date:2018-05-24T00:00:00
db:BIDid:57435date:2015-03-19T09:43:00
db:JVNDBid:JVNDB-2013-002146date:2013-04-05T00:00:00
db:CNNVDid:CNNVD-201301-366date:2013-04-07T00:00:00
db:NVDid:CVE-2013-0663date:2024-11-21T01:47:58.017

SOURCES RELEASE DATE
db:IVDid:03f69634-2353-11e6-abef-000c29c66e3ddate:2013-04-11T00:00:00
db:IVDid:8d5791de-1f35-11e6-abef-000c29c66e3ddate:2013-02-21T00:00:00
db:CNVDid:CNVD-2013-01138date:2013-02-21T00:00:00
db:CNVDid:CNVD-2013-02841date:2013-04-10T00:00:00
db:VULHUBid:VHN-60665date:2013-04-04T00:00:00
db:BIDid:57435date:2013-01-16T00:00:00
db:JVNDBid:JVNDB-2013-002146date:2013-04-05T00:00:00
db:PACKETSTORMid:120311date:2013-02-14T01:37:18
db:CNNVDid:CNNVD-201301-366date:2013-01-18T00:00:00
db:NVDid:CVE-2013-0663date:2013-04-04T11:58:48.687