Summary
Schneider Electric is aware of a vulnerability in its SCADAPack Workbench product.
SCADAPack Workbench is a programming and configuration tool for SCADAPack 300E RTUs and SCADAPack 500E RTUs.
Failure to apply the mitigations provided below may risk information disclosure, which could result from exfiltration of data from local files to a remote system controlled by an attacker.
April 2023 Update: A remediation for the SCADAPack Workbench is available for download (page 1).
Vulnerabilities 1
-
Medium 5.5
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information …
Revision history
-
#2.0.0
Remediation for the SCADAPack Workbench is available for download (page 1).
-
#1.0.0
Original Release
References
-
SCADAPack Workbench - SEVD-2022-087-01 PDF Version
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-087-01_SCADAPackWorkbench_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/