PT-2015-6361 · Schneider Electric · Struxureware Building Expert Mpm

Artyom Kurbatov · Published 2015-09-18 · Updated 2022-02-02 · CVE-2015-3962

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric StruxureWare Building Expert MPM versions prior to 2.15

Description The issue concerns the lack of encryption for the client-server data stream, allowing remote attackers to discover credentials by sniffing the network.

Recommendations For versions prior to 2.15, update to version 2.15 or later to enable encryption for the client-server data stream.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2015-3962

Affected Products

Struxureware Building Expert Mpm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-3962 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01 · Note