PT-2015-5017 · Schneider Electric · Indusoft Web Studio+1

Published 2015-03-29 · Updated 2021-05-14 · CVE-2015-0999

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions prior to 7.1.3.4 SP3 Patch 4 Schneider Electric InTouch Machine Edition 2014 versions prior to 7.1.3.4 SP3 Patch 4

Description The issue allows local users to obtain sensitive information by reading a configuration file that stores cleartext OPC User credentials.

Recommendations For Schneider Electric InduSoft Web Studio versions prior to 7.1.3.4 SP3 Patch 4, update to version 7.1.3.4 SP3 Patch 4 or later. For Schneider Electric InTouch Machine Edition 2014 versions prior to 7.1.3.4 SP3 Patch 4, update to version 7.1.3.4 SP3 Patch 4 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-0999

Affected Products

Intouch Machine Edition 2014

Indusoft Web Studio

References · 4

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0999 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 · Note