Summary
Successful exploitation of this vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as those of the InTouch View process which could lead to a compromise of the InTouch HMI.Systems are only vulnerable if the operating system locales do not use a dot floating point separator.
Vulnerabilities 1
-
Unscored —
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenti…
Revision history
-
#1
ICSA-18-200-02 AVEVA InTouch
References
-
ICS Advisory ICSA-18-200-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-200-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B