What is the CVSS score of CVE-2014-9198?

CVE-2014-9198 has a CVSS 2.0 base score of 10.0 (Critical). CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2014-9198?

Yes, a patch is available for CVE-2014-9198. Update the affected software to the latest version immediately.

Etg3000 Factorycast Hmi Gateway Firmware CVE-2014-9198

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2015-01-27 ics-cert@hq.dhs.gov

Schneider Electric Authentication Bypass Etg3000 Factorycast Hmi Gateway Firmware Tsxetg3000 Tsxetg3010 Tsxetg3021 Tsxetg3022

10.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 27, 2015 - 19:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

AnalysisAI

The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session. Affected products include: Schneider-Electric Etg3000 Factorycast Hmi Gateway Firmware, Schneider-Electric Tsxetg3000, Schneider-Electric Tsxetg3010, Schneider-Electric Tsxetg3021, Schneider-Electric Tsxetg3022. Version information: through 1.60.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.