Configure the secure gateway’s whitelists to restrict access to expected client IPs, as well as to restrict access from the secure gateway to only expected internal server hosts.The address may also be that of a load balancer or proxy, if the secure gateway is deployed that way. This address may be one or more of the IP, machine name, or domain name where the secure gateway is hosted. Configure the HTTP origin header whitelist to match the environment’s URL(s) used for accessing the secure gateway.In addition to installing the provided security patch, Schneider Electric recommends that the following steps be taken to further harden the system: Then install PowerSCADA Anywhere Version 1.1 available in the following location: PowerSCADA Anywhere Version 1 used with PowerSCADA Expert v8.2 and PowerSCADA Expert v8.1: Uninstall PowerSCADA Anywhere (from Add/Remove Programs).The following provides links to instructions for addressing software that is at potential risk for the vulnerabilities: Schneider Electric strongly recommends that users upgrade their systems as soon as possible. Successful exploitation of these vulnerabilities could allow an attacker to perform actions on behalf of a legitimate user, perform network reconnaissance, or gain access to resources beyond those intended with normal operation of the product.
Version 1.0 of PowerSCADA Anywhere redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2,.Schneider Electric reports that the vulnerabilities affect the following versions of PowerSCADA Anywhere and Citect Anywhere mobile extensions: Vulnerabilities: Information Exposure, Cross-Site Request Forgery, Improper Neutralization of Expression, Improper Validation of Certificate Expiration AFFECTED PRODUCTS ATTENTION: Remotely exploitable/low skill level to exploit.Įquipment: PowerSCADA Anywhere and Citect Anywhere
0 kommentar(er)
