CVE-2017-9963: schneider-electric powerscada_anywhere Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2017-9963 is a high (CVSS 8.1) Cross-Site Request Forgery (CSRF) vulnerability in schneider-electric powerscada_anywhere. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.5% of scored vulnerabilities.

Timeline

1. 12-02-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.