Schneider Electric IIoT Monitor (Update A)

Vulnerabilities 4

• Unscored —
  CVE-2018-7835

  An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor …

  Schneider Electric IIoT Monitor 3.1.38 ICS / OT
  Dec 24, 2018
• Unscored —
  CVE-2018-7836 EPSS 32%

  An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 …

  Schneider Electric IIoT Monitor 3.1.38 ICS / OT
  Dec 24, 2018
• Unscored —
  CVE-2018-7837

  An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT M…

  Schneider Electric IIoT Monitor 3.1.38 ICS / OT
  Dec 24, 2018
• Unscored —
  CVE-2018-7839

  A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.

  Schneider Electric IIoT Monitor 3.1.38 ICS / OT
  Feb 6, 2019

Revision history

1. 2019-01-15 #2

   ICSA-19-008-02 Schneider Electric IIoT Monitor (Update A)

2. 2019-01-08 #1

   ICSA-19-008-02 Schneider Electric IIoT Monitor

References

• ICS Advisory ICSA-19-008-02 Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-19-008-02
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/news-events/ics-advisories/icsa-19-008-02