cnvd-2017-22847

EUVD-2026-173793

fkie_cve-2017-7971

A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the use of outdated cipher suites and improper verification of peer SSL Certificate.

GHSA-8f23-48gc-8rgj

ICSA-17-201-01 — Schneider Electric PowerSCADA Anywhere and Citect Anywhere

The secure gateway component of the affected products is vulnerable to CSRF for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.CVE-2017-7969 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). An attacker on an adjacent network may be able to specify arbitrary server target nodes in connection requests to the secure gateway and server components.CVE-2017-7970 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected products use outdated cipher suites and improperly verify peer SSL certificates.CVE-2017-7971 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). An attacker on an adjacent network may be able to escape out of remote applications and launch other processes.CVE-2017-7972 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Most recent entries from all

cnvd-2017-22847

EUVD-2026-173793

fkie_cve-2017-7971

GHSA-8f23-48gc-8rgj

gsd-2017-7971

ICSA-17-201-01 — Schneider Electric PowerSCADA Anywhere and Citect Anywhere