CVE-2013-2796
First published: Fri Aug 09 2013(Updated: )
Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider Electric SCADA Expert Vijeo Citect | <=7.20 | |
| Schneider Electric SCADA Expert Vijeo Citect | =7.10 | |
| Schneider Electric PowerLogic SCADA | <=7.20 | |
| Schneider Electric PowerLogic SCADA | =7.10 | |
| Vijeo Citect | <=7.20 | |
| Vijeo Citect | =7.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2796?
CVE-2013-2796 is classified as a high severity vulnerability.
How do I fix CVE-2013-2796?
To fix CVE-2013-2796, users should upgrade to versions of Vijeo Citect, CitectSCADA, and PowerLogic SCADA later than 7.20.
What types of attacks can CVE-2013-2796 enable?
CVE-2013-2796 can enable remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause denial of service.
Which versions of software are affected by CVE-2013-2796?
CVE-2013-2796 affects Schneider Electric Vijeo Citect, CitectSCADA, and PowerLogic SCADA versions 7.20 and earlier, including 7.10.
Who is the vendor for the affected software in CVE-2013-2796?
The vendor for the affected software in CVE-2013-2796 is Schneider Electric.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider electric scada expert vijeo citect
- version/schneider electric scada expert vijeo citect/7.20
- version/schneider electric scada expert vijeo citect/7.10
- canonical/schneider electric powerlogic scada
- version/schneider electric powerlogic scada/7.20
- version/schneider electric powerlogic scada/7.10
- canonical/vijeo citect
- version/vijeo citect/7.20
- version/vijeo citect/7.10