CVE-2019-10981

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
AVEVA	AVEVA Vijeo Citect and CitectSCADA	Vijeo Citect 7.30 and 7.40 CitectSCADA 7.30 and 7.40

References

http://www.securityfocus.com/bid/108543Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-150-01Mitigation, Third Party Advisory, US Government Resource
https://security.cse.iitk.ac.in/responsible-disclosureThird Party Advisory
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdfPatch, Vendor Advisory
http://www.securityfocus.com/bid/108543Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-150-01Mitigation, Third Party Advisory, US Government Resource
https://security.cse.iitk.ac.in/responsible-disclosureThird Party Advisory
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityAdvisory_LFSec136.pdfPatch, Vendor Advisory

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-109827.8Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by CVE-2019-109837.5In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied d CVE-2019-109847.8Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh CVE-2019-109859.1In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied pat CVE-2019-109878.8In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the l CVE-2019-109883.4In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultras CVE-2019-109899.8In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation o CVE-2019-10996.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-109906.5Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected f CVE-2019-109919.8In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation CVE-2019-109925.5Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclo CVE-2019-109939.8In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute a