Low severity · published May 18, 2018
CVE-2017-9635
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges
3.9
CVSS
0.2%
EPSS
No
On KEV
Description
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Ampla Manufacturing Execution System · Schneider-electric
through 6.4 · source: NVD
Affected product
AM
Ampla Manufacturing Execution System
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9635
Vendor Advisory
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Third Party Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
More from Ampla Manufacturing Execution System
4.1
CVE-2017-9637
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases