Critical vulnerabilities in Schneider Electric industrial solutions

Schneider Electric has reported a vulnerability in its SCADA/HMI solutions InduSoft Web Studio and InTouch Machine Edition versions up to 8.1 (inclusive). The vulnerability has been assigned the ID CVE-2018-8840; its CVSS v.3 score is 9.8.

Successful exploitation of the vulnerability during tag, alarm, or event related actions, could allow remote code execution under high privileges, which could lead to a complete compromise of the target device.

To close the vulnerability, users of the above products are advised to apply the SP1 update package as soon as possible.

Security issues have also been identified in the Triconex Tricon model 3008 Safety Instrumented System. The device is affected by two improper restriction of operations within the bounds of a memory buffer vulnerabilities – CVE-2018-8872 and CVE-2018-7522. These vulnerabilities can be exploited to execute code on the system under attack, shut down the device or compromise the Safety Instrumented System.

To close these vulnerabilities, Schneider Electric recommends updating the controller’s firmware to the latest version (11.x).

Sources: Schneider Electric, ICS-CERT