Wonderware Information Server Multiple Vulnerabilities

CVEs (3)

Remediations

• Invensys has developed software updates to address the reported vulnerabilities. Customers of Invensys running vulnerable versions of Invensys Wonderware Information Server and Invensys Wonderware Historian Client can update their systems to the most recent software updates released by following the steps provided by Invensys. Invensys software updates can be downloaded from the Wonderware Development Network (“Software Download” area) and the Infusion Technical Support website: (https://wdn.wonderware.com/sites/WDN/Pages/Downloads/Software.aspx)
• The following steps are provided by Invensys for update information. Install the Security Update using instructions provided in the ReadMe file for the product and component being installed. In general, the user should proceed as indicated below: Wonderware Information Server – Portal component: Run the “Hotfix Install Utility.” Wonderware Information Server – Client component: Uninstall the client from Add/Remove Programs (ClientSetup.msi), clear the IE cache (see specific instructions in the Readme file provided with the Security Update) and access the Wonderware Information Server site. If Step 2 and Step 3 are on the same node, perform the functions in Step 2 and also run the “Hotfix Install Utility.”
• In addition to applying the software updates, Invensys has made additional recommendations to customers running vulnerable versions of the Invensys Wonderware Information Server and Invensys Wonderware Historian Client products. Customers using versions of the products prior to Invensys Wonderware Information Server 5.0 and Invensys Wonderware Historian Client 10 SP3 should apply the security update to all nodes where the Portal and Client components are installed. (All browser clients of the portal are affected and should be patched). Customers using the affected versions of Invensys Wonderware Information Server should set the security level settings in the Internet browser to “Medium – High” to minimize the risks presented by these vulnerabilities.

Affected Vendors

Affected Products (2)