cnvd - cnvd-2016-10624

CNVD-2016-10624

Vulnerability from cnvd - Published: 2016-11-04

Title

多款Schneider Electric产品拒绝服务漏洞

Description

Schneider Electric Magelis HMI Magelis GTO Advanced Optimum panels等都是法国施耐德电气（Schneider Electric）公司的HMI人机面板系列产品。多款Schneider Electric产品中存在拒绝服务漏洞。攻击者利用漏洞可破坏目标web服务器，导致服务器拒绝服务，设备重启。

Severity

高

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： http://www.schneider-electric.com/

Reference

http://www.schneider-electric.com/ww/en/download/document/SEVD-2016-302-01 http://www.critifence.com/sve/sve.php?id=82003202

Impacted products

Name
['Schneider Electric Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe)', 'Schneider Electric Magelis XBT GT Advanced Touchscreen Panels All', 'Schneider Electric Magelis XBT GK Advanced Touchscreen Panels with Keyboard All', 'Schneider Electric Magelis XBT GH Advanced hand-held Panel All', 'Schneider Electric Magelis STO & STU Small panels All', 'Schneider Electric Magelis GTU Universal panel All', 'Schneider Electric Magelis GTO Advanced Optimum panels All']

Name

['Schneider Electric Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe)', 'Schneider Electric Magelis XBT GT Advanced Touchscreen Panels All', 'Schneider Electric Magelis XBT GK Advanced Touchscreen Panels with Keyboard All', 'Schneider Electric Magelis XBT GH Advanced hand-held Panel All', 'Schneider Electric Magelis STO & STU Small panels All', 'Schneider Electric Magelis GTU Universal panel All', 'Schneider Electric Magelis GTO Advanced Optimum panels All']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8374"
    }
  },
  "description": "Schneider Electric Magelis HMI Magelis GTO Advanced Optimum panels\u7b49\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684HMI\u4eba\u673a\u9762\u677f\u7cfb\u5217\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u4e2d\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u7834\u574f\u76ee\u6807web\u670d\u52a1\u5668\uff0c\u5bfc\u81f4\u670d\u52a1\u5668\u62d2\u7edd\u670d\u52a1\uff0c\u8bbe\u5907\u91cd\u542f\u3002",
  "discovererName": "Eran Goldstein",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttp://www.schneider-electric.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-10624",
  "openTime": "2016-11-04",
  "products": {
    "product": [
      "Schneider Electric Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe)",
      "Schneider Electric Magelis XBT GT Advanced Touchscreen Panels All",
      "Schneider Electric Magelis XBT GK Advanced Touchscreen Panels with Keyboard All",
      "Schneider Electric Magelis XBT GH Advanced hand-held Panel All",
      "Schneider Electric Magelis STO \u0026 STU Small panels All",
      "Schneider Electric Magelis GTU Universal panel All",
      "Schneider Electric Magelis GTO Advanced Optimum panels All"
    ]
  },
  "referenceLink": "http://www.schneider-electric.com/ww/en/download/document/SEVD-2016-302-01\r\nhttp://www.critifence.com/sve/sve.php?id=82003202",
  "serverity": "\u9ad8",
  "submitTime": "2016-11-03",
  "title": "\u591a\u6b3eSchneider Electric\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2016-8374 (GCVE-0-2016-8374)

Vulnerability from cvelistv5 – Published: 2017-02-13 21:00 – Updated: 2024-08-06 02:20

Summary

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION.

Severity ?

No CVSS data available.

CWE

Schneider Electric Magelis HMI Resource Consumption

Assigner

icscert

References

URL

Tags

	https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02	x_refsource_MISC
	http://www.securityfocus.com/bid/94093	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	Schneider Electric Magelis HMI	Affected: Schneider Electric Magelis HMI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:20:30.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02"
          },
          {
            "name": "94093",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94093"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Schneider Electric Magelis HMI",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Schneider Electric Magelis HMI"
            }
          ]
        }
      ],
      "datePublic": "2017-02-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Schneider Electric Magelis HMI Resource Consumption",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-14T10:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02"
        },
        {
          "name": "94093",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94093"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2016-8374",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Schneider Electric Magelis HMI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Schneider Electric Magelis HMI"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Schneider Electric Magelis HMI Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-308-02"
            },
            {
              "name": "94093",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94093"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2016-8374",
    "datePublished": "2017-02-13T21:00:00",
    "dateReserved": "2016-09-28T00:00:00",
    "dateUpdated": "2024-08-06T02:20:30.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-10624

CVE-2016-8374 (GCVE-0-2016-8374)

Tags

Sightings

Nomenclature