Schneider Electric Wonderware Intouch 2014 vulnerabilities

4 CVEs affecting Schneider Electric Wonderware Intouch 2014, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-0999, published 2015-03-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0997, published 2015-03-29. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes…
CVE-2015-0998, published 2015-03-29. Low severity, CVSS 3.3. EPSS: 0.8% chance of exploitation in the next 30 days. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain…
CVE-2015-0999, published 2015-03-29. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which…
CVE-2015-0996, published 2015-03-29. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project…