23 March 2020
KLCERT-20-324: Remote Code Execution on Emerson OpenEnterprise SCADA Server version 2.83 and all versions of OpenEnterprise 3.1 through 3.3.3
Vendor
Emerson
-
CVE-IDS
-
KLCERT
KLCERT-20-324
Timeline
Timeline
-
Kaspersky ICS CERT advisory updated
02 November 2023
-
Kaspersky ICS CERT advisory published
18 February 2020
-
Vendor releases patch
February 2020
-
Vulnerabilities reported
December 2019
Description
CVSS v3
Exploitability
Remotely
Attack complexity
User interaction
Impact
Existence of exploit
Unknown
Affected products
OpenEnterprise SCADA Server version 2.83
OpenEnterprise versions 3.1 through 3.3.3
Mitigation
Vendor mitigation
Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 4 (3.3.4), to resolve this issue. OpenEnterprise Service Packs are available to users with access to the Emerson SupportNet system (login required). Details will be found in the downloads area.
Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
