VULNERABILITY INTELLIGENCE

CVE-2017-6031

CVSS score8.8 HIGH

EPSS probability2.75%

CISA KEVNot currently listed

Published2017-05-06

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.

Weakness classification

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource