Auth bypass in Aveva Clearscada
CVE-2014-5412
Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveraging access to the guest account.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.4 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.016 (74.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Aveva Clearscada — versions 2010, 2013
- Schneider Electric Clearscada — versions 2010 R3.1 (build 72.4644), 2010 R3 (build 72.4560), 2010 R3.2
- Schneider Electric Scada Expert Clearscada — versions 2013 R1.2 (build 73.4955), 2013 R2 (build 74.5094), 2014 R1 (build 75.5210)
- Schneider-Electric Scada Expert Clearscada — versions 2013, 2014
Weakness classification (CWE)
References
- www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a
- github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-259-01a.j…
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory, US Government Resource)