CVE-2012-4709
Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity…
Does this matter?
Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own.
Description
Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- invensys/wonderware intouch
- Source
- ics-cert@hq.dhs.gov
References
- http://ics-cert.us-cert.gov/advisories/ICSA-13-276-01US Government Resource
- http://ics-cert.us-cert.gov/advisories/ICSA-13-276-01US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.