CVE-2019-6833

EUVD-2019-16387
A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
Affected Products (NVD)
VendorProductVersion
schneider-electrichmigto_firmware
-
schneider-electrichmisto_firmware
-
schneider-electricxbtgh_firmware
-
schneider-electrichmigtu_firmware
-
schneider-electrichmiscu_firmware
-
schneider-electrichmistu_firmware
-
schneider-electricxbtgt_firmware
-
schneider-electrichmigxo_firmware
-
schneider-electrichmigxu_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://security.cse.iitk.ac.in/responsible-disclosure
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-225-01
https://security.cse.iitk.ac.in/responsible-disclosure
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-225-01