Detections
Analytics
Schneider Electric SCADA Expert ClearSCADA < 2014 R1.1 and Schneider Electric ClearSCADA < 2010 R3.2 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 8391
Synopsis
A vulnerable version of Schneider Electric ClearSCADA has been detected.Description
SCADA Expert ClearSCADA versions prior to 2014 R1.1 and ClearSCADA versions prior to 2010 R3.2 are affected by multiple vulnerabilities:- Multiple web cross-site scripting vulnerabilities exist. A remote and authenticated user could execute arbitrary script code via unspecified vectors. (CVE-2014-5411)
- A remote authentication bypass vulnerability exists related to the guest user account. An attacker could gain read access to potentially sensitive information or bypass security restrictions to perform unauthorized actions. (CVE-2014-5412)
- A deprecated and weak signing algorithm (MD5) is used for X.509 certificates signed by ClearSCADA. Note that ClearSCADA users who do not use certificates signed by vulnerable versions of ClearSCADA and who have obtained an X.509 certificate signed by a valid Certificate Authority (CA) are not exposed to this vulnerability. (CVE-2014-5413)
Solution
Schneider Electric has fixed these vulnerabilities in SCADA Expert ClearSCADA version 2014 R1.1 and ClearSCADA version 2010 R3.2. Upgrade to SCADA Expert ClearSCADA version 2014 R1.1 or later, or ClearSCADA version 2010 R3.2 or later.See Also
https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD 2014-241-02
Plugin Details
Severity: Medium
ID: 8391
Family: SCADA
Published: 10/17/2014
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:schneider-electric:scada_expert_clearscada
Patch Publication Date: 8/29/2014
Vulnerability Publication Date: 8/29/2014