Open redirect in Schneider Electric products - CVE-2017-5571
Published: May 24, 2018 / Updated: May 28, 2018
Vulnerability identifier: #VU13020
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5571
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to redirect the target user to external websites.
The weakness exists due to open redirect in lmadmin component. A remote attacker can use a specially crafted image link, trick the victim into opening it and redirect users to malicious website.
The weakness exists due to open redirect in lmadmin component. A remote attacker can use a specially crafted image link, trick the victim into opening it and redirect users to malicious website.
Affected software
Citect Anywhere
PlantStruxure PES
EcoStruxure Modicon Builder
StruxureWare Power Monitoring Expert
EcoStruxure Power SCADA Operations
Energy Expert
CitectHistorian
Vijeo Historian
SCADA Expert Vijeo Citect
CitectSCADA
EcoStruxure Power Monitoring Expert
PlantStruxure PES
EcoStruxure Modicon Builder
StruxureWare Power Monitoring Expert
EcoStruxure Power SCADA Operations
Energy Expert
CitectHistorian
Vijeo Historian
SCADA Expert Vijeo Citect
CitectSCADA
EcoStruxure Power Monitoring Expert
How to mitigate CVE-2017-5571
Install update from vendor's website.