Certec EDV GmbH atvise scada (Update A)
ATTENTION: Remotely exploitable/low skill level to exploit.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-6031US | high8.8 | — | ||
A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been ident… | ||||
| CVE-2017-6029US | medium5.4 | — | ||
A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution. | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Mitigationatvise scada
Certec EDV GmbH advises affected users to activate the built-in security mechanism (login, https, protected calls, etc.) of the product as described in the documentation. Users can also upgrade to the newest version of the software available on the Certec EDV GmbH web site (a user login will be needed to obtain the latest version):
http://www.atvise.com/en/component/phocadownload/category/65-patches - Mitigationatvise scada
Certec EDV GmbH advises affected users to activate the built-in security mechanism (login, https, protected calls, etc.) of the product as described in the documentation. Users can also upgrade to the newest version of the software available on the Certec EDV GmbH web site (a user login will be needed to obtain the latest version):
http://www.atvise.com/en/component/phocadownload/category/65-patches - Fixedatvise scada
In order to fully mitigate the vulnerabilities Certec EDV GmbH recommends that users follow the guidelines in the atvise scada documentation for enabling security measures that can be found in the following sections:HTTP/HTTPS support,Protected calls,Login and user management, and User and rights.
- Fixedatvise scada
In order to fully mitigate the vulnerabilities Certec EDV GmbH recommends that users follow the guidelines in the atvise scada documentation for enabling security measures that can be found in the following sections:HTTP/HTTPS support,Protected calls,Login and user management, and User and rights.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan