Schneider Electric SCADA Expert ClearSCADA < 2014 R1.1 and Schneider Electric ClearSCADA < 2010 R3.2 Multiple Vulnerabilities

SCADA Expert ClearSCADA versions prior to 2014 R1.1 and ClearSCADA versions prior to 2010 R3.2 are affected by multiple vulnerabilities:

• Multiple web cross-site scripting vulnerabilities exist. A remote and authenticated user could execute arbitrary script code via unspecified vectors. (CVE-2014-5411)

• A remote authentication bypass vulnerability exists related to the guest user account. An attacker could gain read access to potentially sensitive information or bypass security restrictions to perform unauthorized actions. (CVE-2014-5412)

• A deprecated and weak signing algorithm (MD5) is used for X.509 certificates signed by ClearSCADA. Note that ClearSCADA users who do not use certificates signed by vulnerable versions of ClearSCADA and who have obtained an X.509 certificate signed by a valid Certificate Authority (CA) are not exposed to this vulnerability. (CVE-2014-5413)