CVE-2015-0996

EUVD-2015-1004
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.1 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
avevaaveva_edge
𝑥
< 7.1.3.4
schneider-electricwonderware_intouch_2014
𝑥
< 7.1.3.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01