CVE-2019-6833 MEDIUM

Published: 2019-09-17 | Last Modified: 2026-06-17 | Status: Modified

Description

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-754 - Comprobación inadecuada de condiciones inusuales o excepcionales en los paneles Magelis HMI (todas las versiones de - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU) congelación temporal de la HMI cuando se recibe una alta tasa de tramas. Cuando se detiene el ataque, el panel de HMI procesa los comandos almacenados en el búfer.

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	MEDIUM
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-754
[email protected]	Primary	en CWE-754

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	hmigto_firmware	-	<built-in method update of dict object at 0x7e6110cf5f40>	Operating System
schneider-electric	hmisto_firmware	-	<built-in method update of dict object at 0x7e60a888f680>	Operating System
schneider-electric	xbtgh_firmware	-	<built-in method update of dict object at 0x7e60e8814900>	Operating System
schneider-electric	hmigtu_firmware	-	<built-in method update of dict object at 0x7e60ba25d980>	Hardware
schneider-electric	hmiscu_firmware	-	<built-in method update of dict object at 0x7e6110cf7140>	Operating System
schneider-electric	hmistu_firmware	-	<built-in method update of dict object at 0x7e6110cf5140>	Operating System
schneider-electric	xbtgt_firmware	-	<built-in method update of dict object at 0x7e60ba25c280>	Operating System
schneider-electric	hmigxo_firmware	-	<built-in method update of dict object at 0x7e60a888ccc0>	Operating System
schneider-electric	hmigxu_firmware	-	<built-in method update of dict object at 0x7e60ba25c6c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmigto_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmigto1300:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto1310:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto2300:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto2310:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto2315:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto3510:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto4310:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto5310:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto5315:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto6310:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigto6315:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmisto_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmisto501:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto511:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto512:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto531:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto532:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto705:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto715:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmisto735:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:xbtgh_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:xbtgh2460:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:h:schneider-electric:hmigtu_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmig2u:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig3u:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig3ufc:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig5u:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig5u2:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig5ufc:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmig5ul8a:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmiscu_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmiscu6a5:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmiscu6b5:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmiscu8a5:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmiscu8b5:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmistu_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmistu655:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmistu655w:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmistu855:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmistu855w:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:xbtgt_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:xbtgt2430:-:::::::*`
No	`cpe:2.3:h:schneider-electric:xbtgt2930:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmigxo_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmigxo:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:hmigxu_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:hmigxu35:-:::::::*`
No	`cpe:2.3:h:schneider-electric:hmigxu55:-:::::::*`

References

https://security.cse.iitk.ac.in/responsible-disclosure
Source: [email protected]
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-225-01
Source: [email protected]

Vendor Advisory
https://security.cse.iitk.ac.in/responsible-disclosure
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-225-01
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory