https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01

https://www.tenable.com/security/research/tra-2019-04

46342

The AVEVA InduSoft Web Studio (IWS) or InTouch Edge HMI (formerly InTouch Machine Edition) running on the remote host is affected by a remote code execution vulnerability due to multiple flaws in the TCPIP server listening on the default ports 1234 and 51234. Specifically, the server does not require authentication for command 66 received from a remote client and it can be instructed to read a database connection configuration file from an external host. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to execute arbitrary code under the privileges of the IWS or InTouch Edge HMI runtime.

CVE-2019-6543

critical

Tenable Plugins

critical