CVE-2019-6854

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the file system of that operating system to exploit this vulnerability. Affected versions in current support includes ClearSCADA 2017 R3, ClearSCADA 2017 R2, and ClearSCADA 2017.

CWE-287: Se presenta una vulnerabilidad de autenticación inapropiada en una carpeta dentro de EcoStruxure Geo SCADA Expert (ClearSCADA), con versiones iniciales anteriores al 1 de enero de 2019, lo que podría causar que un usuario con poco privilegio elimine o modifique archivos de bases de datos, configuraciones o certificados . Esos usuarios necesitan tener acceso al sistema de archivos de ese sistema operativo para explotar esta vulnerabilidad. Las versiones afectadas en el soporte actual incluyen ClearSCADA versión 2017 R3, ClearSCADA versión 2017 R2 y ClearSCADA versión 2017

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-25 CVE Reserved
2020-01-06 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-287: Improper Authentication

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.se.com/ww/en/download/document/SEVD-2019-344-05	2021-11-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Schneider-electric Search vendor "Schneider-electric"		Clearscada Search vendor "Schneider-electric" for product "Clearscada"				2017 Search vendor "Schneider-electric" for product "Clearscada" and version "2017"		-		Affected
Schneider-electric Search vendor "Schneider-electric"		Clearscada Search vendor "Schneider-electric" for product "Clearscada"				2017 Search vendor "Schneider-electric" for product "Clearscada" and version "2017"		r2		Affected
Schneider-electric Search vendor "Schneider-electric"		Clearscada Search vendor "Schneider-electric" for product "Clearscada"				2017 Search vendor "Schneider-electric" for product "Clearscada" and version "2017"		r3		Affected