CVE-2014-2381: Schneider Electric Wonderware Inadequate Encryption Strength
Published Aug 28, 2014
·Updated
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows local users to obtain sensitive information by reading a credential file.
Affected Software
5 affected components
Invensys Wonderware Information Server=4.0-sp1
Invensys Wonderware Information Server=4.0-sp1
Invensys Wonderware Information Server=4.5
Invensys Wonderware Information Server=5.0
Invensys Wonderware Information Server=5.5
Remediation
Information
Schneider Electric has created an update for WIS web pages and
components to address the vulnerabilities listed in this advisory.
Customers using all versions of WIS are affected and should upgrade to
WIS Version 5.5 and then apply the security update.
Customers using the affected versions of WIS should set the security
level settings in the Internet browser to “Medium – High” to minimize
the risks presented by these vulnerabilities. In addition, the
Wonderware Information Server Portal can be configured to use HTTPS that
will require additional steps as documented in the products user
documentation.
Schneider Electric has released a security bulletin titled “Multiple
Vulnerabilities in Wonderware Information Server LFSEC00000102” to
announce the security update, which is available at the following
location:
https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000102.pdf
Event History
Aug 28, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:55 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2381?
CVE-2014-2381 is considered a moderate vulnerability due to its impact on sensitive information exposure.
2
How do I fix CVE-2014-2381?
To fix CVE-2014-2381, upgrade to a version of Schneider Electric Wonderware Information Server that uses stronger encryption.
3
What kind of encryption weakness does CVE-2014-2381 have?
CVE-2014-2381 involves weak encryption that can be exploited to access credential files.
4
Which versions of Wonderware Information Server are affected by CVE-2014-2381?
CVE-2014-2381 affects Schneider Electric Wonderware Information Server versions 4.0 SP1 through 5.5.
5
Can local users exploit CVE-2014-2381?
Yes, local users can exploit CVE-2014-2381 to read sensitive information from the weakly encrypted credential file.