CVE-2019-6543
highPriorität · beachten · 55OT-Risiko · hochEPSS 0.173 · 97. PerzentilExploit · PoCEUUSEPSS · bewertet 2026-10-27
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenInTouch Edge HMI (formerly InTouch Machine Edition)cisa_csaf_ot
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip - BehobenInduSoft Web Studiocisa_csaf_ot
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9–10
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- EDB-46342Indusoft Web Studio 8.1 SP2 - Remote Code ExecutionPoC · exploit_db
betroffene Produkte (10)
Betroffene Produkte und Versionsbereiche.
- ICS-CERT AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update≤ AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Updateenisa_euvdEU
- aveva intouch machine edition 2014= r2nvdUScpe:2.3:a:aveva:intouch_machine_edition_2014:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-19-036-01AVEVA InduSoft Web Studio and InTouch Edge HMI2019-02-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a remote attacker to execute an arbitrary process using a specially crafted database connection configuration file.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-6543cnnvd
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf?hsLang=enPatchcnnvd
- https://www.auscert.org.au/bulletins/75070cnnvd
- https://www.exploit-db.com/exploits/46342/cnnvd
- https://www.tenable.com/security/research/tra-2019-04cnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01enisa_euvd
- https://www.exploit-db.com/exploits/46342/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan