CVE-2019-6854: schneider-electric clearscada

csirt@kutim:~/threat-intel/cve/CVE-2019-6854

CVSS 7.8 · High EPSS 0,17%

Kerentanan Improper Authentication pada schneider-electric clearscada. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the file system of that operating system to exploit this vulnerability. Affected versions in current support includes ClearSCADA 2017 R3, ClearSCADA 2017 R2, and ClearSCADA 2017.

Rincian

Terbit di NVD: 6 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 5,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
schneider-electric	clearscada	Versi 2017
schneider-electric	clearscada	Versi 2017 r2
schneider-electric	clearscada	Versi 2017 r3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.se.com/ww/en/download/document/SEVD-2019-344-05/ advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.