Unscored severity · published Mar 29, 2015
CVE-2015-0996
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aveva Edge · Aveva
before 7.1.3.4 · source: NVD
WI
Wonderware Intouch 2014 · Schneider-electric
before 7.1.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0996
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0996
Patch
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01
Patch
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01
More from Aveva Edge
7.8
CVE-2022-36970
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2
7.8
CVE-2022-28688
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000)
7.8
CVE-2022-28687
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000)
7.8
CVE-2022-28686
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000)
7.8
CVE-2022-28685
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000)