{"containers": {"cna": {"affected": [{"product": "OFS v3.5", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "< v7.40 of SCADA Expert Vijeo Citect/CitectSCADA"}, {"status": "affected", "version": "< v7.30 of Vijeo Citect/CitectSCADA"}, {"status": "affected", "version": "< v7.20 of Vijeo Citect/CitectSCADA."}]}], "datePublic": "2015-05-21T00:00:00", "descriptions": [{"lang": "en", "value": "A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "DLL hijacking CWE-427", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-03-25T18:07:36", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2015-1014", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "OFS v3.5", "version": {"version_data": [{"version_value": "< v7.40 of SCADA Expert Vijeo Citect/CitectSCADA"}, {"version_value": "< v7.30 of Vijeo Citect/CitectSCADA"}, {"version_value": "< v7.20 of Vijeo Citect/CitectSCADA."}]}}]}, "vendor_name": "Schneider Electric"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DLL hijacking CWE-427"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2015-1014", "datePublished": "2019-03-25T18:07:36", "dateReserved": "2015-01-10T00:00:00", "dateUpdated": "2019-03-25T18:07:36", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:opc_factory_server:3.5:*:*:*:*:*:*:*", "matchCriteriaId": "AB358AD4-EDE9-4AB0-A43E-72C63997F240", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:citectscada:7.20:*:*:*:*:*:*:*", "matchCriteriaId": "85E1560F-CE61-43C7-A27C-D3686CA72BD0", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:citectscada:7.30:*:*:*:*:*:*:*", "matchCriteriaId": "718E137A-94A1-46E2-B81E-D0812BC4894E", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:citectscada:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "A21DF1A9-A957-419F-A84B-EB73F1FB15FA", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:scada_expert_vijeo_citect:7.20:*:*:*:*:*:*:*", "matchCriteriaId": "ABE06649-0C82-4D18-8587-3B26C4F366EC", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:scada_expert_vijeo_citect:7.30:*:*:*:*:*:*:*", "matchCriteriaId": "A005118C-AB06-4F8C-AED5-FB186534C48D", "vulnerable": false}, {"criteria": "cpe:2.3:a:schneider-electric:scada_expert_vijeo_citect:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "7DCB46CA-EBF8-4318-9671-B5A5D6DED3CE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version."}, {"lang": "es", "value": "Una explotaci\u00f3n exitosa de estas vulnerabilidades requiere que el usuario local suba un archivo DLL manipulado en el directorio de sistemas en los servidores que ejecutan Schneider Electric OFS v3.5 con la versi\u00f3n v7.40 de SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 con la versi\u00f3n v7.30 de Vijeo Citect/CitectSCADA y OFS v3.5 con la versi\u00f3nv7.20 de Vijeo Citect/CitectSCADA. Si la aplicaci\u00f3n intenta abrir ese archivo, podr\u00eda cerrarse inesperadamente o permitir al atacante ejecutar c\u00f3digo arbitrario. Schneider Electric recomienda que los usuarios vulnerables actualicen el OFS a la versi\u00f3n V3.5 e instalen el paquete de servicios m\u00e1s reciente (SP 6 o m\u00e1s reciente) para la versi\u00f3n asociada."}], "id": "CVE-2015-1014", "lastModified": "2019-10-09T23:13:03.937", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-25T19:29:00.337", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "US Government Resource", "Third Party Advisory"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}