AVEVA InduSoft Web Studio and InTouch Edge HMI
Successful exploitation of these vulnerabilities could allow a remote attacker to execute an arbitrary process using a specially crafted database connection configuration file.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-6545US | high7.5 | Exploit | ||
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote use… | ||||
| CVE-2019-6543US | critical9.8OT high | Exploit | ||
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the pr… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- FixedInTouch Edge HMI (formerly InTouch Machine Edition)
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip - FixedInTouch Edge HMI (formerly InTouch Machine Edition)
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip - FixedInduSoft Web Studio
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip - FixedInduSoft Web Studio
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan