Sign-up

ID

VAR-201509-0264


CVE

CVE-2015-7374


TITLE

Schneider Electric InduSoft Web Studio Remote Agent Component code execution vulnerability

Trust: 0.8

sources: IVD: 72899b52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-06460

DESCRIPTION

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-2649 Was numbered.A third party may execute arbitrary code. User interaction is not required to exploit this vulnerability.The specific flaw exists within the Remote Agent service listening on TCP port 1234. The issue lies in the lack of authentication, allowing attackers to execute remote API calls on the service. The Remote Agent is one of the remote agent components. InduSoft Web Studio is prone to a remote code-execution vulnerability

Trust: 3.24

sources: NVD: CVE-2015-7374 // JVNDB: JVNDB-2015-004973 // ZDI: ZDI-15-451 // CNVD: CNVD-2015-06460 // BID: 76864 // IVD: 72899b52-2351-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 72899b52-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-06460

AFFECTED PRODUCTS

vendor:indusoftmodel:web studioscope:lteversion:7.1.3.6

Trust: 1.0

vendor:indusoftmodel:web studioscope:eqversion:7.1.3.6

Trust: 0.9

vendor:schneider electricmodel:indusoft web studioscope:ltversion:8.0

Trust: 0.8

vendor:indusoftmodel:webstudioscope: - version: -

Trust: 0.7

vendor:schneidermodel:electric indusoft web studio remote agentscope: - version: -

Trust: 0.6

vendor:indusoftmodel:web studioscope:eqversion:7.0.104

Trust: 0.3

vendor:indusoftmodel:web studio sp2 p4scope:eqversion:7.1

Trust: 0.3

vendor:indusoftmodel:web studio sp2scope:eqversion:7.1

Trust: 0.3

vendor:indusoftmodel:web studio sp1scope:eqversion:7.1

Trust: 0.3

vendor:indusoftmodel:web studioscope:eqversion:7.1

Trust: 0.3

vendor:indusoftmodel:web studio 7.0b2 hotfixscope:eqversion:7.0.01.

Trust: 0.3

vendor:indusoftmodel:web studio 7.0b2scope: - version: -

Trust: 0.3

vendor:indusoftmodel:web studioscope:eqversion:7.0

Trust: 0.3

vendor:indusoftmodel:web studioscope:eqversion:6.1

Trust: 0.3

vendor:indusoftmodel:web studioscope:neversion:8.0

Trust: 0.3

vendor:web studiomodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 72899b52-2351-11e6-abef-000c29c66e3d // ZDI: ZDI-15-451 // CNVD: CNVD-2015-06460 // BID: 76864 // JVNDB: JVNDB-2015-004973 // CNNVD: CNNVD-201509-550 // NVD: CVE-2015-7374

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7374
value: HIGH

Trust: 1.0

NVD: CVE-2015-7374
value: HIGH

Trust: 0.8

ZDI: CVE-2015-7374
value: HIGH

Trust: 0.7

CNVD: CNVD-2015-06460
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201509-550
value: HIGH

Trust: 0.6

IVD: 72899b52-2351-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2015-7374
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 2.5

CNVD: CNVD-2015-06460
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 72899b52-2351-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 72899b52-2351-11e6-abef-000c29c66e3d // ZDI: ZDI-15-451 // CNVD: CNVD-2015-06460 // JVNDB: JVNDB-2015-004973 // CNNVD: CNNVD-201509-550 // NVD: CVE-2015-7374

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2015-004973 // NVD: CVE-2015-7374

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201509-550

TYPE

Input validation

Trust: 0.8

sources: IVD: 72899b52-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201509-550

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-004973

PATCH
title:SEVD-2015-251-01url:http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-251-01
Trust: 0.8
title:Indusoft has issued an update to correct this vulnerability.url:http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-251-01
Trust: 0.7
title:Schneider Electric InduSoft Web Studio Remote Agent component code execution vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/65016
Trust: 0.6
title:Schneider Electric InduSoft Web Studio Remote Agent Fixes for component input validation vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57806
Trust: 0.6
sources:
            
            
            ZDI: ZDI-15-451 // 
            
            
            
            CNVD: CNVD-2015-06460 // 
            
            
            
            JVNDB: JVNDB-2015-004973 // 
            
            
            
            CNNVD: CNNVD-201509-550

EXTERNAL IDS
db:NVDid:CVE-2015-7374
Trust: 4.2
db:SCHNEIDERid:SEVD-2015-251-01
Trust: 2.5
db:ZDIid:ZDI-15-451
Trust: 2.0
db:CNVDid:CNVD-2015-06460
Trust: 0.8
db:CNNVDid:CNNVD-201509-550
Trust: 0.8
db:JVNDBid:JVNDB-2015-004973
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2649
Trust: 0.7
db:BIDid:76864
Trust: 0.3
db:IVDid:72899B52-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
sources:
            
            
            IVD: 72899b52-2351-11e6-abef-000c29c66e3d // 
            
            
            
            ZDI: ZDI-15-451 // 
            
            
            
            CNVD: CNVD-2015-06460 // 
            
            
            
            BID: 76864 // 
            
            
            
            JVNDB: JVNDB-2015-004973 // 
            
            
            
            CNNVD: CNNVD-201509-550 // 
            
            
            
            NVD: CVE-2015-7374

REFERENCES
url:http://download.schneider-electric.com/files?p_doc_ref=sevd-2015-251-01
Trust: 2.2
url:http://www.zerodayinitiative.com/advisories/zdi-15-451
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7374
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7374
Trust: 0.8
url:http://www.schneider-electric.com/ww/en/download/document/sevd-2015-251-01
Trust: 0.7
url:http://www.indusoft.com/mainpage.php?aricleid=17&type=certified/hardware
Trust: 0.3
url:http://download.schneider-electric.com/files?p_reference=sevd-2015-251-01&p_endoctype=brochure&p_file_id=1079944509&p_file_name=sevd-2015-251-01.pdf
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-451/
Trust: 0.3
sources:
            
            
            ZDI: ZDI-15-451 // 
            
            
            
            CNVD: CNVD-2015-06460 // 
            
            
            
            BID: 76864 // 
            
            
            
            JVNDB: JVNDB-2015-004973 // 
            
            
            
            CNNVD: CNNVD-201509-550 // 
            
            
            
            NVD: CVE-2015-7374

CREDITS
Steven Seeley of Source Incite
Trust: 1.0
sources:
            
            
            ZDI: ZDI-15-451 // 
            
            
            
            BID: 76864

SOURCES
db:IVDid:72899b52-2351-11e6-abef-000c29c66e3d
db:ZDIid:ZDI-15-451
db:CNVDid:CNVD-2015-06460
db:BIDid:76864
db:JVNDBid:JVNDB-2015-004973
db:CNNVDid:CNNVD-201509-550
db:NVDid:CVE-2015-7374

LAST UPDATE DATE
2024-11-23T21:43:56.305000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-451date:2015-09-28T00:00:00
db:CNVDid:CNVD-2015-06460date:2015-10-13T00:00:00
db:BIDid:76864date:2015-09-28T00:00:00
db:JVNDBid:JVNDB-2015-004973date:2015-09-30T00:00:00
db:CNNVDid:CNNVD-201509-550date:2015-10-09T00:00:00
db:NVDid:CVE-2015-7374date:2024-11-21T02:36:40.837

SOURCES RELEASE DATE
db:IVDid:72899b52-2351-11e6-abef-000c29c66e3ddate:2015-10-13T00:00:00
db:ZDIid:ZDI-15-451date:2015-09-28T00:00:00
db:CNVDid:CNVD-2015-06460date:2015-10-13T00:00:00
db:BIDid:76864date:2015-09-28T00:00:00
db:JVNDBid:JVNDB-2015-004973date:2015-09-30T00:00:00
db:CNNVDid:CNNVD-201509-550date:2015-09-29T00:00:00
db:NVDid:CVE-2015-7374date:2015-09-25T14:59:00.133