Schneider Electric Accutech Manager 'RFManagerService' SQL Injection

critical Nessus Plugin ID 70921

Language:

Synopsis

The remote host is affected by a SQL injection vulnerability.

Description

The remote host has a version of Schneider Electric Accutech Manager installed that is affected by a SQL injection vulnerability. By sending a specially crafted packet to 'RFManagerService' listening on port 2536, an attacker is able to authenticate to the service and then manipulate the software.

Solution

Configure the firewalls to only permit specific systems to access ports 2536 and 2537.

Plugin Details

Severity: Critical

ID: 70921

File Name: scada_schneider_electric_accutech_manager_sql.nbin

Version: 1.73

Type: remote

Family: SCADA

Published: 11/15/2013

Updated: 3/19/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:schneider-electric:accutech_manager

Excluded KB Items: global_settings/supplied_logins_only

Exploit Ease: No known exploits are available

Patch Publication Date: 11/15/2013

Vulnerability Publication Date: 11/15/2013

Reference Information

BID: 64684

Detections

Analytics