Schneider Electric InduSoft Web Studio < 7.1.3.4 Multiple Information Disclosures (SEVD-2015-054-01)

According to its self-reported version, the installation of Schneider Electric InduSoft Web Studio running on the remote host is prior to 7.1.3.4. It is, therefore, affected by the multiple information disclosure vulnerabilities :

• A hard-coded plaintext password is used to control read access to files. A local attacker can exploit this to access sensitive information stored in project and project configuration files. (CVE-2015-0996)

• The HMI user interface presents valid usernames to the screen when connecting to the server via the HMI. A remote attacker can use this information to conduct brute-force password attacks. (CVE-2015-0997)

• User credentials are transmitted in cleartext. A man-in-the-middle attacker can exploit this, by sniffing the network, to obtain user credentials. (CVE-2015-0998)

• OPC user credentials are stored in plaintext in a configuration file. A local attacker can exploit this to obtain user credentials. (CVE-2015-0999)