CVE-2014-9197: Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function

Published Jan 27, 2015

Updated

The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

Affected Software

10 affected components

Schneider-electric Etg3000 Factorycast Hmi Gateway Firmware=1.60.2

Schneider-electric Tsxetg3000

Schneider-electric Tsxetg3010

Schneider-electric Tsxetg3021

Schneider-electric Tsxetg3022

All of the following

Schneider-electric Etg3000 Factorycast Hmi Gateway Firmware=1.60.2

Any of the following

Schneider-electric Tsxetg3000

Schneider-electric Tsxetg3010

Schneider-electric Tsxetg3021

Schneider-electric Tsxetg3022

Remediation

Patch Available

https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02

Information

Schneider Electric has produced an updated firmware, labelled V1.60 IR 04. This firmware release moves the jar files directory in a secure area. The new firmware also includes the ability to disable the FTP server. This updated firmware can be downloaded at: http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/?showAsIframe... http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/

Event History

Jan 27, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-9197?

CVE-2014-9197 has a medium severity level due to its potential to expose sensitive information.

How do I fix CVE-2014-9197?

To fix CVE-2014-9197, upgrade the firmware of the Schneider Electric ETG3000 FactoryCast HMI Gateway to version 1.60 IR 04 or later.

What type of information is exposed by CVE-2014-9197?

CVE-2014-9197 allows remote attackers to obtain sensitive setup and configuration information.

Which products are affected by CVE-2014-9197?

CVE-2014-9197 affects Schneider Electric's ETG3000 FactoryCast HMI Gateway with firmware versions before 1.60 IR 04.

Is CVE-2014-9197 a remote vulnerability?

Yes, CVE-2014-9197 is a remote vulnerability that can be exploited without physical access to the device.