Skip to main content

Wonderware Information Server CVE-2014-2380

HIGH
Inadequate Encryption Strength (CWE-326)
2014-08-28 ics-cert@hq.dhs.gov
Schneider Electric Information Disclosure Wonderware Information Server
7.8
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:N/AC:L/Au:N/C:C/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 28, 2014 - 01:55 cve.org
HIGH 7.8

DescriptionCVE.org

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

AnalysisAI

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-326. Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file. Affected products include: Invensys Wonderware Information Server. Version information: through 5.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wonderware Information Server

View all
CVE-2013-0685 CRITICAL
9.3 May 09

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size
CVE-2013-0686 CRITICAL
9.3 May 09

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read ar
CVE-2012-0226 HIGH
7.5 Apr 02

SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute
CVE-2014-5397 HIGH
7.5 Aug 28

Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 throug
CVE-2014-5399 HIGH
7.5 Aug 28

SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows

CVE-2012-0228 HIGH
7.5 Apr 02

Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote

CVE-2013-0684 HIGH
7.5 May 09

SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal all
CVE-2012-0258 MEDIUM
6.8 Apr 02

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware A
CVE-2012-0257 MEDIUM
6.8 Apr 02

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware A
CVE-2012-3005 MEDIUM
6.9 Jul 26

Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application S
CVE-2012-0225 MEDIUM
4.3 Apr 02

Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attacke
CVE-2013-0688 MEDIUM
4.3 May 09

Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.

Same weakness CWE-326 – Inadequate Encryption Strength

View all
CVE-2017-1000486 CRITICAL POC
9.8
CVE-2017-11317 CRITICAL POC
9.8
CVE-2014-0224 HIGH POC
7.4
CVE-2013-2566 MEDIUM POC
5.9
CVE-2021-42216 CRITICAL POC
9.8
CVE-2017-8076 CRITICAL POC
9.8
CVE-2017-7888 CRITICAL POC
9.8
CVE-2018-25272 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2014-2380 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy