VulnerabilityModified
CVE-2019-6545
An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.
HIGH 7.5EPSS 13.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 13.86% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-99
- Affected
- aveva/indusoft web studio · aveva/intouch machine edition 2014
- Source
- ics-cert@hq.dhs.gov
References
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01Mitigation, Third Party Advisory, US Government Resource
- https://www.exploit-db.com/exploits/46342/Exploit, Third Party Advisory, VDB Entry
- https://www.tenable.com/security/research/tra-2019-04Third Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01Mitigation, Third Party Advisory, US Government Resource
- https://www.exploit-db.com/exploits/46342/Exploit, Third Party Advisory, VDB Entry
- https://www.tenable.com/security/research/tra-2019-04Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.