Sign-up

ID

VAR-201905-1065


CVE

CVE-2019-10981


TITLE

Vijeo Citect  and  CitectSCADA  Vulnerability regarding insufficient protection of authentication information in

Trust: 0.8

sources: JVNDB: JVNDB-2019-004984

DESCRIPTION

In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials. Vijeo Citect and CitectSCADA There are vulnerabilities in inadequate protection of credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA are a set of data acquisition and monitoring systems (SCADA) software from Schneider Electric. A security vulnerability exists in SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA that caused the program to fail to adequately protect the credentials. AVEVA Vijeo Citect and CitectSCADA are prone to an information-disclosure vulnerability. Attackers can exploit this issue to to obtain the sensitive information. The following products of AVEVA are vulnerable: Vijeo Citect 7.30 and 7.40 CitectSCADA 7.30 and 7.40. The following products and versions are affected: Schneider Electric AVEVA Vijeo Citect Version 7.30, Version 7.40; Schneider Electric AVEVA CitectSCADA Version 7.30, Version 7.40

Trust: 2.7

sources: NVD: CVE-2019-10981 // JVNDB: JVNDB-2019-004984 // CNVD: CNVD-2019-16225 // BID: 108543 // IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1 // VULHUB: VHN-142582

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1 // CNVD: CNVD-2019-16225

AFFECTED PRODUCTS

vendor:schneider electricmodel:citectscadascope:eqversion:7.30

Trust: 1.0

vendor:schneider electricmodel:citectscadascope:eqversion:7.40

Trust: 1.0

vendor:schneider electricmodel:scada expert vijeo citectscope:eqversion:7.30

Trust: 1.0

vendor:schneider electricmodel:scada expert vijeo citectscope:eqversion:7.40

Trust: 1.0

vendor:schneider electricmodel:citectscadascope: - version: -

Trust: 0.8

vendor:schneider electricmodel:vijeo citectscope:eqversion:7.40

Trust: 0.8

vendor:schneider electricmodel:vijeo citectscope:eqversion:7.30

Trust: 0.8

vendor:schneidermodel:electric aveva vijeo citectscope:eqversion:7.30

Trust: 0.6

vendor:schneidermodel:electric aveva vijeo citectscope:eqversion:7.40

Trust: 0.6

vendor:schneidermodel:electric aveva citectscadascope:eqversion:7.30

Trust: 0.6

vendor:schneidermodel:electric aveva citectscadascope:eqversion:7.40

Trust: 0.6

vendor:avevamodel:software vijeo citectscope:eqversion:7.40

Trust: 0.3

vendor:avevamodel:software vijeo citectscope:eqversion:7.30

Trust: 0.3

vendor:avevamodel:software citectscadascope:eqversion:7.40

Trust: 0.3

vendor:avevamodel:software citectscadascope:eqversion:7.30

Trust: 0.3

vendor:citectscadamodel: - scope:eqversion:7.30

Trust: 0.2

vendor:citectscadamodel: - scope:eqversion:7.40

Trust: 0.2

vendor:scada expert vijeo citectmodel: - scope:eqversion:7.30

Trust: 0.2

vendor:scada expert vijeo citectmodel: - scope:eqversion:7.40

Trust: 0.2

sources: IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1 // CNVD: CNVD-2019-16225 // BID: 108543 // JVNDB: JVNDB-2019-004984 // NVD: CVE-2019-10981

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-10981
value: HIGH

Trust: 1.0

NVD: CVE-2019-10981
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-16225
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201905-1129
value: HIGH

Trust: 0.6

IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1
value: HIGH

Trust: 0.2

VULHUB: VHN-142582
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2019-10981
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-16225
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-142582
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-10981
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-10981
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1 // CNVD: CNVD-2019-16225 // VULHUB: VHN-142582 // JVNDB: JVNDB-2019-004984 // CNNVD: CNNVD-201905-1129 // NVD: CVE-2019-10981

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.1

problemtype:Inadequate protection of credentials (CWE-522) [ others ]

Trust: 0.8

problemtype: Inadequate protection of credentials (CWE-522) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-255

Trust: 0.1

sources: VULHUB: VHN-142582 // JVNDB: JVNDB-2019-004984 // NVD: CVE-2019-10981

THREAT TYPE

local

Trust: 0.9

sources: BID: 108543 // CNNVD: CNNVD-201905-1129

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201905-1129

PATCH

title:AVEVA Security Advisory LFSEC00000136url:https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdf

Trust: 0.8

title:SchneiderElectricAVEVAVijeoCitect and SchneiderElectricAVEVACitectSCADA patches for insecure credential storage vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/162721

Trust: 0.6

title:Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=93067

Trust: 0.6

sources: CNVD: CNVD-2019-16225 // JVNDB: JVNDB-2019-004984 // CNNVD: CNNVD-201905-1129

EXTERNAL IDS

db:NVDid:CVE-2019-10981

Trust: 4.4

db:ICS CERTid:ICSA-19-150-01

Trust: 3.4

db:BIDid:108543

Trust: 2.0

db:AUSCERTid:ESB-2019.1954

Trust: 1.2

db:CNNVDid:CNNVD-201905-1129

Trust: 0.9

db:CNVDid:CNVD-2019-16225

Trust: 0.8

db:JVNDBid:JVNDB-2019-004984

Trust: 0.8

db:AUSCERTid:ESB-2019.1954.2

Trust: 0.6

db:IVDid:BB0C5588-F2B1-49C3-BBF6-837CD34AC4D1

Trust: 0.2

db:VULHUBid:VHN-142582

Trust: 0.1

sources: IVD: bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1 // CNVD: CNVD-2019-16225 // VULHUB: VHN-142582 // BID: 108543 // JVNDB: JVNDB-2019-004984 // CNNVD: CNNVD-201905-1129 // NVD: CVE-2019-10981

REFERENCES

url:https://ics-cert.us-cert.gov/advisories/icsa-19-150-01

Trust: 3.4

url:http://www.securityfocus.com/bid/108543

Trust: 2.9

url:https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/securityadvisory_lfsec136.pdf

Trust: 2.0

url:https://security.cse.iitk.ac.in/responsible-disclosure

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2019-10981

Trust: 1.4

url:https://www.auscert.org.au/bulletins/esb-2019.1954/

Trust: 1.2

url:https://www.aveva.com

Trust: 0.9

url:https://www.auscert.org.au/bulletins/esb-2019.1954.2/

Trust: 0.6

sources: CNVD: CNVD-2019-16225 // VULHUB: VHN-142582 // BID: 108543 // JVNDB: JVNDB-2019-004984 // CNNVD: CNNVD-201905-1129 // NVD: CVE-2019-10981

CREDITS

VAPT Team, C3i Center, and IIT Kanpur, and IIT Kanpur., and IIT Kanpur reported this vulnerability to AVEVA.

Trust: 0.6

sources: CNNVD: CNNVD-201905-1129

SOURCES

db:IVDid:bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1
db:CNVDid:CNVD-2019-16225
db:VULHUBid:VHN-142582
db:BIDid:108543
db:JVNDBid:JVNDB-2019-004984
db:CNNVDid:CNNVD-201905-1129
db:NVDid:CVE-2019-10981

LAST UPDATE DATE

2024-12-28T23:09:45.512000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2019-16225date:2019-06-02T00:00:00
db:VULHUBid:VHN-142582date:2020-10-02T00:00:00
db:BIDid:108543date:2019-05-21T00:00:00
db:JVNDBid:JVNDB-2019-004984date:2024-12-27T06:00:00
db:CNNVDid:CNNVD-201905-1129date:2020-10-09T00:00:00
db:NVDid:CVE-2019-10981date:2024-11-21T04:20:17.440

SOURCES RELEASE DATE

db:IVDid:bb0c5588-f2b1-49c3-bbf6-837cd34ac4d1date:2019-06-02T00:00:00
db:CNVDid:CNVD-2019-16225date:2019-06-02T00:00:00
db:VULHUBid:VHN-142582date:2019-05-31T00:00:00
db:BIDid:108543date:2019-05-21T00:00:00
db:JVNDBid:JVNDB-2019-004984date:2019-06-13T00:00:00
db:CNNVDid:CNNVD-201905-1129date:2019-05-30T00:00:00
db:NVDid:CVE-2019-10981date:2019-05-31T21:29:02.267