XML external entity security vulnerabilities of multiple Schneider Electric Products

Release date:
Updated on:

Affected Systems:
Schneider Electric Vijeo Citect 7.20
Description:
--------------------------------------------------------------------------------
Bugtraq id: 61598

Schneider Electric Group provides products and services for energy and infrastructure, industry, data centers and networks, buildings and residential areas.

Vijeo Citect 7.20, CitectSCADA 7.20, and PowerLogic SCADA 7.20 have security vulnerabilities. Local attackers can exploit this vulnerability to obtain sensitive information or cause DoS attacks.

<* Source: Timur Yunusov
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Schneider Electric
------------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.schneider-electric.com/sites/corporate/en/support/cybersecurity/cyber-security-vulnerabil