KLA10508 Multiple vulnerabilities in Schneider Electric products

Multiple serious vulnerabilities have been found in Schneider Electric products. Malicious users can exploit these vulnerabilities to obtain sensitive information orbypass security restrictions.

Below is a complete list of vulnerabilities

1. Improper credentials storing and transmitting can be exploited locally via file manipulations or network sniffing;
2. Publication list of usernames can be exploited remotely via conducting brute-force attack.

Original advisories

SE bulletin

SE bulletin

Related products

InduSoft-Web-Studio

CVE list

CVE-2015-0996 warning

CVE-2015-0999 warning

CVE-2015-0997 critical

CVE-2015-0998 warning

Solution

Update to the latest version

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4Schneider Electric InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4