20 мая 2020

KLCERT-20-010: Improper Ownership Management in Emerson OpenEnterprise SCADA before 3.3.4

Vendor

Emerson

Timeline

Timeline

  • Kaspersky ICS CERT advisory published

    20 мая 2020

  • Vendor releases patch

    Май 2020

  • Vulnerabilities reported

    Декабрь 2019

Description

Improper Ownership Management in Emerson OpenEnterprise SCADA versions before 3.3.4.

CVSS v3

0.0

 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Exploitability

Local

Attack complexity

Low

User interaction

None

Impact

Inadequate folder security permissions may allow modification of important configuration files which could cause the system to fail or behave in an unpredictable manner.

Existence of exploit

PoC

Affected products

Emerson OpenEnterprise SCADA versions before 3.3.4.

Mitigation

Vendor mitigation

Emerson recommends all users upgrade your OpenEnterprise system to OpenEnterprise 3.3.5 (OpenEnterprise 3.3 Service Pack 5). All computers with OpenEnterprise installations must be upgraded.

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Вернуться к началу

Timeline

  • Kaspersky ICS CERT advisory published

    20 мая 2020

  • Vendor releases patch

    Май 2020

  • Vulnerabilities reported

    Декабрь 2019

Вернуться к началу
Подписка на рассылку