CVE-2015-0998

2015-03-2910:59:07

CWE-200

[email protected]

web.nvd.nist.gov

schneider electric

indusoft web studio

intouch machine edition

cve-2015-0998

cleartext credentials

remote attackers

sensitive information

network sniffing

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.8%

JSON

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected configurations

NVD

Node

avevaaveva_edgeRange<7.1.3.4

schneider-electricwonderware_intouch_2014Range<7.1.3.4machine

CPENameOperatorVersion
aveva:aveva_edgeaveva aveva edgelt7.1.3.4
schneider-electric:wonderware_intouch_2014schneider-electric wonderware intouch 2014lt7.1.3.4