CVE-2015-1009 Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users...
LowCVSS 1.7
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| indusoft web studio | <= 7.1.3.5 | No fix listed |
| wonderware intouch | <= 7.1 | No fix listed |
References
- download.schneider-electric.com vendor-advisory
- gcsresource.invensys.com
- ics-cert.us-cert.gov third-party-advisory us-government-resource