Description
Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References (2)
Core 2
Core References
Patch x_refsource_confirm
http://www.citect.schneider-electric.com/cs-HF720SP459363
US Government Resource x_refsource_misc
http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02
Scores
EPSS
0.0015
EPSS Percentile
35.0%
Details
CWE
CWE-264
Status
published
Products (6)
schneider-electric/citectscada
7.10
schneider-electric/citectscada
< 7.20
schneider-electric/powerlogic_scada
7.10
schneider-electric/powerlogic_scada
< 7.20
schneider-electric/vijeo_citect
7.10
schneider-electric/vijeo_citect
< 7.20
Published
Aug 09, 2013
Tracked Since
Feb 18, 2026