CVE-2019-6833 : A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.

Published 2019-09-17 20:15:12

Updated 2020-02-10 21:53:41

Source Schneider Electric SE

View at NVD, CVE.org

Products affected by CVE-2019-6833

Schneider-electric » Hmigto Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmigto_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmigto1300 » Version: N/A
When used together with: Schneider-electric » Hmigto1310 » Version: N/A
When used together with: Schneider-electric » Hmigto2300 » Version: N/A
When used together with: Schneider-electric » Hmigto2310 » Version: N/A
When used together with: Schneider-electric » Hmigto2315 » Version: N/A
When used together with: Schneider-electric » Hmigto3510 » Version: N/A
When used together with: Schneider-electric » Hmigto4310 » Version: N/A
When used together with: Schneider-electric » Hmigto5310 » Version: N/A
When used together with: Schneider-electric » Hmigto5315 » Version: N/A
When used together with: Schneider-electric » Hmigto6310 » Version: N/A
When used together with: Schneider-electric » Hmigto6315 » Version: N/A
Schneider-electric » Hmisto Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmisto_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmisto501 » Version: N/A
When used together with: Schneider-electric » Hmisto511 » Version: N/A
When used together with: Schneider-electric » Hmisto512 » Version: N/A
When used together with: Schneider-electric » Hmisto531 » Version: N/A
When used together with: Schneider-electric » Hmisto532 » Version: N/A
When used together with: Schneider-electric » Hmisto705 » Version: N/A
When used together with: Schneider-electric » Hmisto715 » Version: N/A
When used together with: Schneider-electric » Hmisto735 » Version: N/A
Schneider-electric » Xbtgh Firmware » Version: N/A
cpe:2.3:o:schneider-electric:xbtgh_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Xbtgh2460 » Version: N/A
Schneider-electric » Hmigtu Firmware » Version: N/A
cpe:2.3:h:schneider-electric:hmigtu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmig2u » Version: N/A
When used together with: Schneider-electric » Hmig3u » Version: N/A
When used together with: Schneider-electric » Hmig3ufc » Version: N/A
When used together with: Schneider-electric » Hmig5u » Version: N/A
When used together with: Schneider-electric » Hmig5u2 » Version: N/A
When used together with: Schneider-electric » Hmig5ufc » Version: N/A
When used together with: Schneider-electric » Hmig5ul8a » Version: N/A
Schneider-electric » Hmiscu Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmiscu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmiscu6a5 » Version: N/A
When used together with: Schneider-electric » Hmiscu6b5 » Version: N/A
When used together with: Schneider-electric » Hmiscu8a5 » Version: N/A
When used together with: Schneider-electric » Hmiscu8b5 » Version: N/A
Schneider-electric » Hmistu Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmistu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmistu655 » Version: N/A
When used together with: Schneider-electric » Hmistu655w » Version: N/A
When used together with: Schneider-electric » Hmistu855 » Version: N/A
When used together with: Schneider-electric » Hmistu855w » Version: N/A
Schneider-electric » Xbtgt Firmware » Version: N/A
cpe:2.3:o:schneider-electric:xbtgt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Xbtgt2430 » Version: N/A
When used together with: Schneider-electric » Xbtgt2930 » Version: N/A
Schneider-electric » Hmigxo Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmigxo_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmigxo » Version: N/A
Schneider-electric » Hmigxu Firmware » Version: N/A
cpe:2.3:o:schneider-electric:hmigxu_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Hmigxu35 » Version: N/A
When used together with: Schneider-electric » Hmigxu55 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-6833

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-6833

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-6833

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Assigned by:
- cybersecurity@se.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2019-6833

https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-225-01

Security Notification - Magelis HMI Panels | Schneider Electric
Vendor Advisory
https://security.cse.iitk.ac.in/responsible-disclosure

Responsible Disclosure | Indian Institute of Technology, Kanpur

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-6833

Products affected by CVE-2019-6833

Exploit prediction scoring system (EPSS) score for CVE-2019-6833

CVSS scores for CVE-2019-6833

CWE ids for CVE-2019-6833

References for CVE-2019-6833