10

CVE-2019-6543

Exploit
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp5
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp6_p3
Aveva ≫ Indusoft Web Studio Version 7.1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p4
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p5
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p6
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p7
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p8
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p9
Aveva ≫ Indusoft Web Studio Version 8.0
Aveva ≫ Indusoft Web Studio Version 8.0 Update p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update p2
Aveva ≫ Indusoft Web Studio Version 8.0 Update p3
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1_p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2_p1
Aveva ≫ Indusoft Web Studio Version 8.1
Aveva ≫ Indusoft Web Studio Version 8.1 Update p1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1_p1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.29% 0.967
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/46342/
Third Party Advisory
Exploit
VDB Entry
https://www.tenable.com/security/research/tra-2019-04
Third Party Advisory