Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-2796

Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Published

2013-08-09T23:55:02.537

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.9 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.4

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application schneider-electric citectscada ≤ 7.20 Yes
Application schneider-electric citectscada 7.10 Yes
Application schneider-electric powerlogic_scada ≤ 7.20 Yes
Application schneider-electric powerlogic_scada 7.10 Yes
Application schneider-electric vijeo_citect ≤ 7.20 Yes
Application schneider-electric vijeo_citect 7.10 Yes
References