CVE-2015-0997

CWE-200 — Information Exposure4 documents4 sources

Severity

5.0MEDIUM

EPSS

0.6%

top 30.52%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Aveva Aveva Edge Schneider-electric Wonderware Intouch 2014

Timeline

PublishedMar 29

Latest updateMay 13

Description

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDschneider-electric/wonderware_intouch_2014< 7.1

▶NVDaveva/aveva_edge< 7.1.3.4

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

GHSA

GHSA-jf3r-fxmm-grph: Schneider Electric InduSoft Web Studio before 7↗2022-05-13

▶

CVEList

CVE-2015-0997: Schneider Electric InduSoft Web Studio before 7↗2015-03-29

▶

💥Exploits & PoCs

Exploit-DB

Android WiFi-Direct - Denial of Service↗2015-01-26

▶