Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power SCADA Anywhere product.
EcoStruxure™ Power SCADA Anywhere is an on-premises software that provides remote web browser access to the EcoStruxure Power Operation desktop HMI client application and its operator interface.
Failure to apply with the mitigations provided below may risk an authenticated user to escape from the context of EcoStruxure™ Power SCADA Anywhere into the Operating System (OS), which could result in arbitrary OS commands being executed on the system.
Vulnerabilities 1
-
High 7.4
AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere appli…
Revision history
-
#1
Original Release
References
-
EcoStruxure™ Power SCADA Anywhere - SEVD-2023-010-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-04_EcoStruxure_Power_SCADA_Anywhere_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/