AVEVA Wonderware License Server
Act Now9.8ICS-CERT ICSA-18-212-05Jul 31, 2018
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A buffer overflow vulnerability (CWE-119) in AVEVA Wonderware License Server, Historian Client, and Information Server allows unauthenticated remote code execution with administrative privileges. The vulnerability affects Historian Client 2014 R4 SP2 P02 and prior, Wonderware License Server v4.0.13100 and prior, and Wonderware Information Server 4.0 SP1 and prior. Successful exploitation could allow an attacker to run arbitrary commands on the License Server with system-level privileges, potentially compromising dependent SCADA and HMI systems.
What this means
What could happen
An attacker could gain remote administrative access to the Wonderware License Server and execute arbitrary commands, potentially disrupting or taking control of SCADA/HMI systems that depend on it for software licensing and data collection.
Who's at risk
Water utilities and electric power operators who rely on Wonderware for SCADA data collection, HMI, and process historian functions. Specifically impacts Historian Client 2014 R4 and earlier, Wonderware License Server v4.0.13100 and earlier, and Wonderware Information Server 4.0 SP1 and earlier. Any facility using these AVEVA products for real-time process monitoring and control system licensing is at risk.
How it could be exploited
An attacker on the network (or Internet-reachable network) sends a malicious network request to the Wonderware License Server (port/service unspecified in advisory). The buffer overflow vulnerability allows the attacker to execute arbitrary code with the privileges of the License Server process, typically SYSTEM or administrator-level.
Prerequisites
- Network access to Wonderware License Server service
- No authentication required
- Affected version 4.0.13100 or prior must be running
remotely exploitableno authentication requiredlow complexityhigh EPSS score (80.5%)affects SCADA/HMI systemsno patch available for some products
Exploitability
High exploit probability (EPSS 80.5%)
Affected products (3)
1 with fix2 EOL
ProductAffected VersionsFix Status
Wonderware License Server: v4.0.13100 and prior≤ 4.0.13100VU-485744 or later
Historian Client: 2014 R4 SP2 P02 and prior≤ 2014 R4 SP2 P02No fix (EOL)
Wonderware Information Server: 4.0 SP1 and prior≤ 4.0 SP1No fix (EOL)
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to Wonderware License Server to authorized engineering and supervisory networks only; block inbound access from the Internet and untrusted networks at the firewall
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXInstall Hotfix Wonderware License Server VU-485744 or later from Schneider Electric support portal
Mitigations - no patch available
0/2The following products have reached End of Life with no planned fix: Historian Client: 2014 R4 SP2 P02 and prior, Wonderware Information Server: 4.0 SP1 and prior. Apply the following compensating controls:
HARDENINGIsolate Wonderware License Server and Historian Client systems behind a firewall and on a dedicated control network separate from the business IT network
HARDENINGFor remote access, require use of a VPN with current security patches and strong authentication
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/db37554e-8eef-4e8c-9d26-9aa57915a640