CVE-2019-6543 : Security Advisory and Response

CVE-2019-6543, published on February 5, 2019, addresses security vulnerabilities in AVEVA Software, LLC's InduSoft Web Studio and InTouch Edge HMI.

Understanding CVE-2019-6543

This CVE entry highlights a potential security risk in versions of InduSoft Web Studio and InTouch Edge HMI prior to specific updates.

What is CVE-2019-6543?

Before Version 8.1 SP3 of InduSoft Web Studio and before Version 2017 Update of InTouch Edge HMI, these software products could expose machines to security vulnerabilities by allowing code execution with program runtime privileges.

The Impact of CVE-2019-6543

The vulnerability could lead to unauthorized code execution with elevated privileges, potentially compromising the security of the affected systems.

Technical Details of CVE-2019-6543

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The issue stems from the lack of proper authentication for critical functions (CWE-306), enabling attackers to execute code with elevated privileges.

Affected Systems and Versions

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3
InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update

Exploitation Mechanism

Attackers can exploit this vulnerability to execute malicious code on the affected systems, potentially leading to unauthorized access and control.

Mitigation and Prevention

Protecting systems from CVE-2019-6543 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update AVEVA Software, LLC InduSoft Web Studio to Version 8.1 SP3 or later.
Update InTouch Edge HMI to Version 2017 Update or newer.
Implement proper access controls and authentication mechanisms.

Long-Term Security Practices

Regularly monitor for security updates and patches from the software vendor.
Conduct security assessments and penetration testing to identify and address vulnerabilities.

Patching and Updates

Apply security patches promptly to ensure that known vulnerabilities are mitigated.