Certec EDV GmbH atvise scada (Update A)
ATTENTION: Remotely exploitable/low skill level to exploit.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-6031US | high8.8 | — | ||
A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been ident… | ||||
| CVE-2017-6029US | medium5.4 | — | ||
A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- Mitigationatvise scada
Certec EDV GmbH advises affected users to activate the built-in security mechanism (login, https, protected calls, etc.) of the product as described in the documentation. Users can also upgrade to the newest version of the software available on the Certec EDV GmbH web site (a user login will be needed to obtain the latest version):
http://www.atvise.com/en/component/phocadownload/category/65-patches - Mitigationatvise scada
Certec EDV GmbH advises affected users to activate the built-in security mechanism (login, https, protected calls, etc.) of the product as described in the documentation. Users can also upgrade to the newest version of the software available on the Certec EDV GmbH web site (a user login will be needed to obtain the latest version):
http://www.atvise.com/en/component/phocadownload/category/65-patches - Behobenatvise scada
In order to fully mitigate the vulnerabilities Certec EDV GmbH recommends that users follow the guidelines in the atvise scada documentation for enabling security measures that can be found in the following sections:HTTP/HTTPS support,Protected calls,Login and user management, and User and rights.
- Behobenatvise scada
In order to fully mitigate the vulnerabilities Certec EDV GmbH recommends that users follow the guidelines in the atvise scada documentation for enabling security measures that can be found in the following sections:HTTP/HTTPS support,Protected calls,Login and user management, and User and rights.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan