PT-2017-16349 · Schneider Electric · Wonderware Historian

Published 2017-02-13 · Updated 2019-10-03 · CVE-2017-5155

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Historian versions 2014 R2 SP1 P01 and earlier

Description An issue was discovered where Wonderware Historian creates logins with default passwords, allowing a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may also be compromised.

Recommendations For versions 2014 R2 SP1 P01 and earlier, change the default passwords for all logins created by Wonderware Historian to prevent potential compromise of Historian databases and other resources.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2017-5155

Affected Products

Wonderware Historian

References · 6

• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5155 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-024-01 · Note
• http://securityfocus.com/bid/95766 · Note
• http://securitytracker.com/id/1037808 · Note