AVEVA InTouch
Successful exploitation of this vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as those of the InTouch View process which could lead to a compromise of the InTouch HMI.Systems are only vulnerable if the operating system locales do not use a dot floating point separator.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-10628US | critical9.8 | — | ||
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could over… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationInTouch
To contact AVEVA support visit https://softwaresupport.aveva.com/
https://softwaresupport.aveva.com/ - FixedInTouch
InTouch 2014 R2 SP1 - Apply HF-11_1_SP1/CR149705 as soon as possible. Those using versions of InTouch older than 2014 R2 SP1 should first upgrade to a supported version of InTouch and then apply the corresponding hotfix.
https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5057
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan