PT-2015-4153 · Schneider Electric · Etg3000 Factorycast Hmi Gateway

Narendra Shinde · Published 2015-01-27 · Updated 2025-09-05 · CVE-2014-9198

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric ETG3000 FactoryCast HMI Gateway versions through 1.60 IR 04

Description The issue concerns hardcoded credentials in the FTP server, making it easier for remote attackers to gain access via an FTP session.

Recommendations For versions through 1.60 IR 04, consider disabling the FTP server or restricting its access until a patch is available to remove the hardcoded credentials.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-255

CWE-798

Related Identifiers

CVE-2014-9198

Affected Products

Etg3000 Factorycast Hmi Gateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-9198 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02 · Patch
• https://cisa.gov/news-events/ics-advisories/icsa-15-020-02 · Note
• http://securityfocus.com/bid/72258 · Note
• https://t.me/cveNotify/134517 · Telegram Post
• http://securityfocus.com/bid/77765 · Note