The affected products can process an XML document that can contain XML entities with URLs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Improper Restriction of XML External Entity Reference a Vulnerability Characterization Vulnerability Overview Schneider Electric reports operations in over 100 countries worldwide. The affected Schneider Electric systems are found primarily in energy, manufacturing, and infrastructure applications. Schneider Electric is a manufacturer and integrator of energy management and industrial automation systems, equipment, and software. ICS‑CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization. The vulnerability could lead to the disclosure of confidential information by allowing access to local files and internal resources or cause the server to potentially execute arbitrary HTTP requests, or affect system availability.

PowerLogic SCADA Version 7.20 and all previous versions.

CitectSCADA Version 7.20 and all previous versions, and.

Vijeo Citect Version 7.20 and all previous versions,.

Schneider Electric reports that the vulnerability affects the following products: Schneider Electric has produced patches that mitigate this vulnerability. Timur Yunusov, Alexey Osipov, and Ilya Karpov of Positive Technologies reported the vulnerability directly to Schneider Electric. Schneider Electric has identified an XML external entity vulnerability in Vijeo Citect, CitectSCADA, and PowerLogic SCADA applications.

Citect support