CVE-2019-6525: aveva wonderware_system_platform Insufficiently Protected Credentials
Vulnerability summary
CVE-2019-6525 is a high (CVSS 8.8) Insufficiently Protected Credentials vulnerability in aveva wonderware_system_platform. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 71% of scored vulnerabilities.
Timeline
- 11-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Aveva1 product
- wonderware_system_platform2017 Update 2 and prior | < 2017 | 2017 | 2017:update_1 | 2017:update_2
1 vendor · 1 product
References
2 links- ics-cert.us-cert.gov/advisories/ICSA-19-029-03X Refsource MISCThird Party AdvisoryUS Government Resource
- sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec135.pdfX Refsource CONFIRMVendor Advisory