Auth bypass in Schneider-Electric Clearscada

CVE-2019-6854

A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the file system of that operating system to exploit this vulnerability. Affected versions in current support includes ClearSCADA 2017 R3, ClearSCADA 2017 R2, and ClearSCADA 2017.

Vulnerability class: Broken Authentication

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (5.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2019-6854: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Schneider-Electric Clearscada — versions 2017
  • Ecostruxure Geo Scada Expert (Clearscada) With Initial Releases Before 1 January 2019 (See Notification For More Details) — versions EcoStruxure Geo SCADA Expert (ClearSCADA) with initial releases before 1 January 2019 (see notification for more details)

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2019-6854?
CVE-2019-6854 is a high-severity vulnerability in Schneider-Electric Clearscada, classified under Improper Authentication. CVSS score: 7.8/10. Published 2020-01-06.
How severe is CVE-2019-6854?
High severity. CVSS v3 base score is 7.8 out of 10.