CVE-2019-13537 - The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash

Back Back to CVE browser

HIGH

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash

Published Jan 14, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.30%

Description

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash.

Affected products

Vendor Aveva Product Vijeo Citect and Citect SCADA Default
n/a
- Version
  IEC870IP driver v4.14.02 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Aveva

Vijeo Citect and Citect SCADA

n/a

Version	Status	Constraints
IEC870IP driver v4.14.02 and prior	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4992
Advisory
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdf
x_refsource_CONFIRMVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-290-01
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4992		Advisory
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdf		x_refsource_CONFIRMVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-290-01		x_refsource_MISCThird Party AdvisoryUS Government Resource