Medium severity · published May 18, 2018
CVE-2017-9637
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases
4.1
CVSS
0.2%
EPSS
No
On KEV
Description
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Ampla Manufacturing Execution System · Schneider-electric
through 6.4 · source: NVD
Affected product
AM
Ampla Manufacturing Execution System
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9637
Vendor Advisory
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Third Party Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
More from Ampla Manufacturing Execution System
3.9
CVE-2017-9635
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges