Schneider-Electric Wonderware Intouch 2014 vulnerabilities

4 known vulnerabilities affecting schneider-electric/wonderware_intouch_2014.

Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM1LOW3

Vulnerabilities

Page 1 of 1
CVE-2015-0997MEDIUMCVSS 5.0fixed in 7.12015-03-29
CVE-2015-0997 [MEDIUM] CWE-200 CVE-2015-0997: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 b Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
nvd
CVE-2015-0998LOWCVSS 3.3fixed in 7.1.3.42015-03-29
CVE-2015-0998 [LOW] CWE-200 CVE-2015-0998: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 b Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
nvd
CVE-2015-0996LOWCVSS 2.1fixed in 7.1.3.42015-03-29
CVE-2015-0996 [LOW] CWE-200 CVE-2015-0996: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 b Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
nvd
CVE-2015-0999LOWCVSS 2.1fixed in 7.1.3.42015-03-29
CVE-2015-0999 [LOW] CWE-200 CVE-2015-0999: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 b Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
nvd