Improper input validation in Aveva Clearscada
CVE-2017-6021
In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.017 (75.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: -0.000
Affected products
- Aveva Clearscada
- Schneider-Electric Clearscada — versions 2014, 2015
- Schneider Electric Se Clearscada — versions 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior
Weakness classification (CWE)
References
- www.securityfocus.com/bid/96768 (VDB Entry, Third Party Advisory, vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-17-068-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-6021?
- CVE-2017-6021 is a high-severity vulnerability in Aveva Clearscada, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-05-14.
- How severe is CVE-2017-6021?
- High severity. CVSS v3 base score is 7.5 out of 10.