CVE-2017-5155

Severity Score

7.3

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may be compromised as well.

Ha sido descubierto un problema en Schneider Electric Wonderware Historian 2014 R2 SP1 P01 y versiones anteriores. Wonderware Historian crea inicios de sesión con contraseñas predeterminadas, lo que puede permitir que una entidad maliciosa comprometer las bases de datos de Historian. En algunos escenarios de instalación, los recursos además de los creados por Wonderware Historian también pueden verse comprometidos.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-01-03 CVE Reserved
2017-02-13 CVE Published
2023-03-07 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-1188: Initialization of a Resource with an Insecure Default

CAPEC

References (4)

URL	Tag	Source
http://www.securityfocus.com/bid/95766	Third Party Advisory
http://www.securitytracker.com/id/1037808	Vdb Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-024-01	Mitigation

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000115	2019-10-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Schneider-electric Search vendor "Schneider-electric"		Wonderware Historian Search vendor "Schneider-electric" for product "Wonderware Historian"				2014_r2_sp1_p01 Search vendor "Schneider-electric" for product "Wonderware Historian" and version "2014_r2_sp1_p01"		-		Affected