Sign-up

ID

VAR-201711-0412


CVE

CVE-2017-14024


TITLE

Schneider Electric InduSoft Web Studio and InTouch Machine Edition Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-010277

DESCRIPTION

A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges. Multiple Schneider Electric Products are prone to an unspecified stack-based buffer-overflow vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition

Trust: 2.7

sources: NVD: CVE-2017-14024 // JVNDB: JVNDB-2017-010277 // CNVD: CNVD-2017-33815 // BID: 101779 // IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // VULMON: CVE-2017-14024

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // CNVD: CNVD-2017-33815

AFFECTED PRODUCTS

vendor:schneider electricmodel:wonderware indusoft web studioscope:lteversion:8.0

Trust: 1.0

vendor:schneider electricmodel:wonderware intouchscope:lteversion:8.0

Trust: 1.0

vendor:schneider electricmodel:indusoft web studioscope:lteversion:8.0 sp2 patch 1

Trust: 0.8

vendor:schneider electricmodel:intouch machinescope:lteversion:8.0 sp2 patch 1

Trust: 0.8

vendor:schneidermodel:electric indusoft web studio sp2scope:lteversion:<=8.0

Trust: 0.6

vendor:schneidermodel:electric intouch machine edition sp2scope:lteversion:<=8.0

Trust: 0.6

vendor:schneider electricmodel:wonderware indusoft web studioscope:eqversion:8.0

Trust: 0.6

vendor:schneider electricmodel:wonderware intouchscope:eqversion:8.0

Trust: 0.6

vendor:schneider electricmodel:intouch machine edition sp2 patchscope:eqversion:8.01

Trust: 0.3

vendor:schneider electricmodel:indusoft web studio sp2 patchscope:eqversion:8.01

Trust: 0.3

vendor:wonderware indusoft web studiomodel: - scope:eqversion:*

Trust: 0.2

vendor:wonderware intouchmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // CNVD: CNVD-2017-33815 // BID: 101779 // JVNDB: JVNDB-2017-010277 // CNNVD: CNNVD-201708-1251 // NVD: CVE-2017-14024

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-14024
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-14024
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2017-33815
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201708-1251
value: CRITICAL

Trust: 0.6

IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9
value: CRITICAL

Trust: 0.2

VULMON: CVE-2017-14024
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-14024
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2017-33815
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-14024
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // CNVD: CNVD-2017-33815 // VULMON: CVE-2017-14024 // JVNDB: JVNDB-2017-010277 // CNNVD: CNNVD-201708-1251 // NVD: CVE-2017-14024

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2017-010277 // NVD: CVE-2017-14024

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-1251

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // CNNVD: CNNVD-201708-1251

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-010277

PATCH
title:トップページurl:https://www.schneider-electric.co.jp/ja/
Trust: 0.8
title:Patch for Schneider Electric InduSoft Web Studio and InTouch Machine Edition Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/106020
Trust: 0.6
title:Schneider Electric InduSoft Web Studio  and InTouch Machine Edition Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76096
Trust: 0.6
title:Threatposturl:https://threatpost.com/schneider-electric-patches-critical-rce-vulnerability/131610/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-33815 // 
            
            
            
            VULMON: CVE-2017-14024 // 
            
            
            
            JVNDB: JVNDB-2017-010277 // 
            
            
            
            CNNVD: CNNVD-201708-1251

EXTERNAL IDS
db:NVDid:CVE-2017-14024
Trust: 3.6
db:ICS CERTid:ICSA-17-313-02
Trust: 3.4
db:BIDid:101779
Trust: 1.4
db:CNVDid:CNVD-2017-33815
Trust: 0.8
db:CNNVDid:CNNVD-201708-1251
Trust: 0.8
db:JVNDBid:JVNDB-2017-010277
Trust: 0.8
db:IVDid:76E97BDB-4BDC-429E-8C2D-D41AD80DC8D9
Trust: 0.2
db:VULMONid:CVE-2017-14024
Trust: 0.1
sources:
            
            
            IVD: 76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9 // 
            
            
            
            CNVD: CNVD-2017-33815 // 
            
            
            
            VULMON: CVE-2017-14024 // 
            
            
            
            BID: 101779 // 
            
            
            
            JVNDB: JVNDB-2017-010277 // 
            
            
            
            CNNVD: CNNVD-201708-1251 // 
            
            
            
            NVD: CVE-2017-14024

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-313-02
Trust: 3.4
url:http://www.securityfocus.com/bid/101779
Trust: 1.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14024
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-14024
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/schneider-electric-patches-critical-rce-vulnerability/131610/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-33815 // 
            
            
            
            VULMON: CVE-2017-14024 // 
            
            
            
            BID: 101779 // 
            
            
            
            JVNDB: JVNDB-2017-010277 // 
            
            
            
            CNNVD: CNNVD-201708-1251 // 
            
            
            
            NVD: CVE-2017-14024

CREDITS
Aaron Portnoy, formerly of Exodus Intelligence
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201708-1251

SOURCES
db:IVDid:76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9
db:CNVDid:CNVD-2017-33815
db:VULMONid:CVE-2017-14024
db:BIDid:101779
db:JVNDBid:JVNDB-2017-010277
db:CNNVDid:CNNVD-201708-1251
db:NVDid:CVE-2017-14024

LAST UPDATE DATE
2025-04-20T23:42:55.100000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-33815date:2017-11-14T00:00:00
db:VULMONid:CVE-2017-14024date:2017-12-01T00:00:00
db:BIDid:101779date:2017-12-19T21:00:00
db:JVNDBid:JVNDB-2017-010277date:2017-12-11T00:00:00
db:CNNVDid:CNNVD-201708-1251date:2017-11-13T00:00:00
db:NVDid:CVE-2017-14024date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:76e97bdb-4bdc-429e-8c2d-d41ad80dc8d9date:2017-11-14T00:00:00
db:CNVDid:CNVD-2017-33815date:2017-11-14T00:00:00
db:VULMONid:CVE-2017-14024date:2017-11-13T00:00:00
db:BIDid:101779date:2017-11-09T00:00:00
db:JVNDBid:JVNDB-2017-010277date:2017-12-11T00:00:00
db:CNNVDid:CNNVD-201708-1251date:2017-11-09T00:00:00
db:NVDid:CVE-2017-14024date:2017-11-13T20:29:00.350