Aveva Wonderware Intouch Access Anywhere vulnerabilities

3 CVEs affecting Aveva Wonderware Intouch Access Anywhere, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-5160, published 2017-04-20.

More from Aveva.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-5158, published 2017-04-20. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL…
• CVE-2017-5156, published 2017-04-20. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will…
• CVE-2017-5160, published 2017-04-20. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security…