Full Report
An information exposure vulnerability exists in PcVue 12, allowing a non-authorized user to access session data of legitimate users.
Analysis Summary
# Vulnerability: Session Information Exposure in ARC Informatique PcVue
## CVE Details
- CVE ID: CVE-2020-26869
- CVSS Score: 9.8 (High) (Based on the provided CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- CWE: [Not explicitly provided, but implies CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]
## Affected Systems
- Products: ARC Informatique PcVue
- Versions: PcVue 12.0.7 (inclusive) through 12.0.23 (exclusive)
- Configurations: Affects systems utilizing the WebVue, WebScheduler, or TouchVue mobile app features (which use the Property Server).
## Vulnerability Description
An information exposure vulnerability exists in PcVue 12, where an unauthenticated remote attacker can gain access to the session data of legitimate users. This data exposure occurs when users connect via WebVue, WebScheduler, or the TouchVue mobile application. The vulnerability vector appears to be accessible over the network (likely related to port 8090/TCP mentioned in mitigation).
## Exploitation
- Status: PoC available (Implied by "Existence of exploit PoC")
- Complexity: Low (AV:N/AC:L/PR:N/UI:N indicates Network access, Low Complexity, No Privilege Required, No User Interaction)
- Attack Vector: Network
## Impact
- Confidentiality: High (C:H - Access to user session data)
- Integrity: None (I:N)
- Availability: None (A:N)
## Remediation
### Patches
- Update ARC Informatique PcVue software to version **v12.0.23 or newer**.
- If Web & Mobile extensions are not required, ensure they are not installed. If they are required, they should only be installed on the PcVue Web back end server.
### Workarounds
- Configure the border firewall (or similar network traffic control) to **only allow authorized parties to send traffic to port 8090/TCP** of the system.
- Use **Virtual Private Networks (VPN)** to secure remote access to the industrial network and encrypt traffic.
- Implement **network segmentation** and strict access control for each network segment.
- Implement a **Network Intrusion Detection System (NIDS)** to monitor for abnormal network connections and traffic directed at the affected device.
## Detection
- **Indicators of Compromise:** Look for unexpected or unauthorized network connections or data transfers targeting port 8090/TCP on PcVue Web/Property Servers by non-authorized entities.
- **Detection Methods and Tools:** Network Intrusion Detection Systems (NIDS) capable of monitoring traffic patterns on relevant ports (e.g., 8090/TCP) for anomalous session data requests or successful unauthorized data extraction.
## References
- Vendor Advisory: ARC Informatique (Specific advisory link not provided in source text)
- ICS CERT Advisory: https://ics-cert.kaspersky.com/advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/
- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-26869