Details of VAR-201304-0151

ID

VAR-201304-0151

CVE

CVE-2013-0664

TITLE

Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability

Trust: 0.8

sources: IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138

DESCRIPTION

The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests. Schneider Electric Ethernetmokuai has a cross-site request forgery vulnerability that allows an attacker to build a malicious URI, entice a user to resolve, and perform malicious actions, such as changing passwords, in the context of the target user. The following versions are affected by this vulnerability: Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. The SESU tool used by several of these products is used to update software on Windows PC systems. The mechanism sent to the PLC via the Modbus command does not require authentication, allowing the attacker to send these messages to perform stop operations, modify I/O data, and so on. Schneider Electric Products are prone to multiple security vulnerabilities. Successfully exploiting these issues allows remote attackers to execute arbitrary code or perform unauthorized actions in the context of the user's session; other attacks are also possible. Note: The denial-of-service vulnerability issue affecting Modicon M340 and the authentication-bypass issue affecting Maagelis XBT HMI were determined not to be vulnerabilities. The following Schneider Electric products are affected: BMX NOE 0110 Modicon M340. Schneider Electric software on customer PCs uses the SESU service as a communication mechanism to the Schneider Electric central update server, which can be used to receive software updates on a regular basis. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA52189 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52189/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52189 RELEASE DATE: 2013-02-14 DISCUSS ADVISORY: http://secunia.com/advisories/52189/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52189/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52189 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Schneider Electric Ethernet Modules, which can be exploited by malicious people to conduct cross-site request forgery attacks. The vulnerability is caused due to the modules allowing users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change credentials when a logged-in administrator visits a specially crafted web page. Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100 SOLUTION: No official solution is currently available. PROVIDED AND/OR DISCOVERED BY: The vendor credits Arthur Gervais. ORIGINAL ADVISORY: SEVD-2013-023-01: http://download.schneider-electric.com/files?L=en&p=&p_docId=&p_docId=&p_Reference=SEVD%202013-023-01&p_EnDocType=Technical%20paper&p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.51

sources: NVD: CVE-2013-0664 // JVNDB: JVNDB-2013-002147 // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02842 // BID: 57435 // IVD: 03c08c56-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // VULHUB: VHN-60666 // PACKETSTORM: 120311

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.6

sources: IVD: 03c08c56-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02842

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon quantum plc	scope:	eq	version:	140noe77111	Trust: 2.4
vendor:	schneider electric	model:	modicon quantum plc	scope:	eq	version:	140nwm10000	Trust: 2.4
vendor:	schneider electric	model:	modicon m340	scope:	eq	version:	bmxnoe0110x	Trust: 1.6
vendor:	schneider electric	model:	modicon premium	scope:	eq	version:	tsxety5103	Trust: 1.6
vendor:	schneider electric	model:	modicon m340 pac	scope:	eq	version:	bmxnoe0110x	Trust: 0.8
vendor:	schneider electric	model:	modicon premium plc	scope:	eq	version:	tsxety5103	Trust: 0.8
vendor:	schneider	model:	electric m340 series modules	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon quantum series modules	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric premium series modules	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric quantum 140noe77111	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric quantum 140nwm10000	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric premium tsxety5103	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric m340 bmxnoe0110x	scope:	-	version:	-	Trust: 0.6
vendor:	modicon quantum plc	model:	140noe77111	scope:	-	version:	-	Trust: 0.2
vendor:	modicon quantum plc	model:	140nwm10000	scope:	-	version:	-	Trust: 0.2
vendor:	modicon m340	model:	bmxnoe0110x	scope:	-	version:	-	Trust: 0.2
vendor:	modicon premium	model:	tsxety5103	scope:	-	version:	-	Trust: 0.2
vendor:	schneider	model:	electric m340 series modules null	scope:	eq	version:	*	Trust: 0.2
vendor:	schneider	model:	electric modicon quantum series modules null	scope:	eq	version:	*	Trust: 0.2
vendor:	schneider	model:	electric premium series modules null	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 03c08c56-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02842 // JVNDB: JVNDB-2013-002147 // CNNVD: CNNVD-201303-351 // NVD: CVE-2013-0664

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-0664
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-0664
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2013-02842
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201303-351
value:	HIGH
Trust: 0.6
IVD:	03c08c56-2353-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2
IVD:	8d5791de-1f35-11e6-abef-000c29c66e3d
value:	LOW
Trust: 0.2
VULHUB:	VHN-60666
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-0664
severity:	HIGH
baseScore:	8.5
vectorString:	AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.8
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2013-02842
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	03c08c56-2353-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	8d5791de-1f35-11e6-abef-000c29c66e3d
severity:	NONE
baseScore:	NONE
vectorString:	NONE
accessVector:	NONE
accessComplexity:	NONE
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	UNKNOWN
Trust: 0.2
VULHUB:	VHN-60666
severity:	HIGH
baseScore:	8.5
vectorString:	AV:N/AC:M/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.8
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: IVD: 03c08c56-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02842 // VULHUB: VHN-60666 // JVNDB: JVNDB-2013-002147 // CNNVD: CNNVD-201303-351 // NVD: CVE-2013-0664

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2013-0664

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201303-351

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201303-351

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-002147

PATCH

title:	Important Security Notification - M340, Quantum. and Premium Ethernet communication modules	url:	http://download.schneider-electric.com/files?p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf	Trust: 0.8
title:	SEVD 2013-023-01	url:	http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/	Trust: 0.8
title:	サポート	url:	http://www.schneider-electric.co.jp/sites/japan/jp/support/contact/we-care.page	Trust: 0.8
title:	トップページ	url:	http://www.schneider-electric.com/site/home/index.cfm/jp/	Trust: 0.8
title:	Multiple Schneider Electric products incorrectly verify patches for vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/33180	Trust: 0.6

sources: CNVD: CNVD-2013-02842 // JVNDB: JVNDB-2013-002147

EXTERNAL IDS

db:	NVD	id:	CVE-2013-0664	Trust: 3.6
db:	ICS CERT	id:	ICSA-13-077-01A	Trust: 3.4
db:	SCHNEIDER	id:	SEVD-2013-023-01	Trust: 2.4
db:	BID	id:	57435	Trust: 1.5
db:	CNNVD	id:	CNNVD-201303-351	Trust: 0.9
db:	CNVD	id:	CNVD-2013-02842	Trust: 0.8
db:	CNVD	id:	CNVD-2013-01138	Trust: 0.8
db:	SECUNIA	id:	52189	Trust: 0.8
db:	JVNDB	id:	JVNDB-2013-002147	Trust: 0.8
db:	ICS CERT	id:	ICSA-13-077-01	Trust: 0.3
db:	ICS CERT	id:	ICSA-13-077-01B	Trust: 0.3
db:	ICS CERT ALERT	id:	ICS-ALERT-13-016-01	Trust: 0.3
db:	ICS CERT ALERT	id:	ICS-ALERT-13-016-01A	Trust: 0.3
db:	IVD	id:	03C08C56-2353-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	IVD	id:	8D5791DE-1F35-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	VULHUB	id:	VHN-60666	Trust: 0.1
db:	PACKETSTORM	id:	120311	Trust: 0.1

sources: IVD: 03c08c56-2353-11e6-abef-000c29c66e3d // IVD: 8d5791de-1f35-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02842 // VULHUB: VHN-60666 // BID: 57435 // JVNDB: JVNDB-2013-002147 // PACKETSTORM: 120311 // CNNVD: CNNVD-201303-351 // NVD: CVE-2013-0664

REFERENCES

url:	http://ics-cert.us-cert.gov/pdf/icsa-13-077-01a.pdf	Trust: 3.4
url:	http://www.schneider-electric.com/download/ww/en/file/36555639-sevd-2013-023-01.pdf/?filename=sevd-2013-023-01.pdf&reference=sevd-2013-023-01&doctype=technical-paper	Trust: 2.2
url:	http://www.schneider-electric.com/download/ww/en/details/35081317-vulnerability-disclosure-for-quantum-premium-and-m340/	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0664	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0664	Trust: 0.8
url:	http://secunia.com/advisories/52189/	Trust: 0.7
url:	http://www.securityfocus.com/bid/57435	Trust: 0.6
url:	http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true	Trust: 0.3
url:	http://www.us-cert.gov/control_systems/pdf/ics-alert-13-016-01.pdf	Trust: 0.3
url:	http://ics-cert.us-cert.gov/pdf/ics-alert-13-016-01a.pdf	Trust: 0.3
url:	http://ics-cert.us-cert.gov/pdf/icsa-13-077-01.pdf	Trust: 0.3
url:	http://ics-cert.us-cert.gov/advisories/icsa-13-077-01b	Trust: 0.3
url:	http://www.schneider-electric.com/download/ww/en/file/36555639-sevd-2013-023-01.pdf/?filename=sevd-2013-023-01.pdf&reference=sevd-2013-023-01&doctype=technical-paper	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=52189	Trust: 0.1
url:	http://download.schneider-electric.com/files?l=en&p=&p_docid=&p_docid=&p_reference=sevd%202013-023-01&p_endoctype=technical%20paper&p_file_id=36555639&p_file_name=sevd-2013-023-01.pdf	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/52189/#comments	Trust: 0.1
url:	http://secunia.com/blog/325/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CNVD: CNVD-2013-01138 // CNVD: CNVD-2013-02842 // VULHUB: VHN-60666 // BID: 57435 // JVNDB: JVNDB-2013-002147 // PACKETSTORM: 120311 // CNNVD: CNNVD-201303-351 // NVD: CVE-2013-0664

CREDITS

Arthur Gervais

Trust: 0.9

sources: BID: 57435 // CNNVD: CNNVD-201303-351

SOURCES

db:	IVD	id:	03c08c56-2353-11e6-abef-000c29c66e3d
db:	IVD	id:	8d5791de-1f35-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2013-01138
db:	CNVD	id:	CNVD-2013-02842
db:	VULHUB	id:	VHN-60666
db:	BID	id:	57435
db:	JVNDB	id:	JVNDB-2013-002147
db:	PACKETSTORM	id:	120311
db:	CNNVD	id:	CNNVD-201303-351
db:	NVD	id:	CVE-2013-0664

LAST UPDATE DATE

2024-11-23T21:51:40.378000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-01138	date:	2013-05-28T00:00:00
db:	CNVD	id:	CNVD-2013-02842	date:	2013-04-10T00:00:00
db:	VULHUB	id:	VHN-60666	date:	2013-04-04T00:00:00
db:	BID	id:	57435	date:	2015-03-19T09:43:00
db:	JVNDB	id:	JVNDB-2013-002147	date:	2013-04-05T00:00:00
db:	CNNVD	id:	CNNVD-201303-351	date:	2013-04-17T00:00:00
db:	NVD	id:	CVE-2013-0664	date:	2024-11-21T01:47:58.130

SOURCES RELEASE DATE

db:	IVD	id:	03c08c56-2353-11e6-abef-000c29c66e3d	date:	2013-04-11T00:00:00
db:	IVD	id:	8d5791de-1f35-11e6-abef-000c29c66e3d	date:	2013-02-21T00:00:00
db:	CNVD	id:	CNVD-2013-01138	date:	2013-02-21T00:00:00
db:	CNVD	id:	CNVD-2013-02842	date:	2013-04-10T00:00:00
db:	VULHUB	id:	VHN-60666	date:	2013-04-04T00:00:00
db:	BID	id:	57435	date:	2013-01-16T00:00:00
db:	JVNDB	id:	JVNDB-2013-002147	date:	2013-04-05T00:00:00
db:	PACKETSTORM	id:	120311	date:	2013-02-14T01:37:18
db:	CNNVD	id:	CNNVD-201303-351	date:	2013-01-16T00:00:00
db:	NVD	id:	CVE-2013-0664	date:	2013-04-04T11:58:49.823