CVE-2014-9198: Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials

Q: What is the severity of CVE-2014-9198?

CVE-2014-9198 has a medium severity level due to the presence of hardcoded credentials that can be exploited by remote attackers.

Q: How do I fix CVE-2014-9198?

To fix CVE-2014-9198, update the ETG3000 FactoryCast HMI Gateway firmware to a version after 1.60 IR 04 that corrects the hardcoded credential issue.

Q: What systems are affected by CVE-2014-9198?

CVE-2014-9198 affects Schneider Electric ETG3000 FactoryCast HMI Gateways with firmware versions up to and including 1.60 IR 04.

Q: What type of attack is possible with CVE-2014-9198?

CVE-2014-9198 allows remote attackers to gain unauthorized access via FTP sessions due to hardcoded credentials.

Q: Are there any workarounds for CVE-2014-9198?

Currently, there are no effective workarounds for CVE-2014-9198 besides upgrading the firmware to prevent unauthorized FTP access.

Published Jan 27, 2015

Updated

The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

Affected Software

10 affected components

Schneider-electric Etg3000 Factorycast Hmi Gateway Firmware<=1.60.4

Schneider-electric Tsxetg3000

Schneider-electric Tsxetg3010

Schneider-electric Tsxetg3021

Schneider-electric Tsxetg3022

All of the following

Schneider-electric Etg3000 Factorycast Hmi Gateway Firmware<=1.60.4

Any of the following

Schneider-electric Tsxetg3000

Schneider-electric Tsxetg3010

Schneider-electric Tsxetg3021

Schneider-electric Tsxetg3022

Remediation

Patch Available

https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02

Information

Schneider Electric has produced an updated firmware, labelled V1.60 IR 04. This firmware release moves the jar files directory in a secure area. The new firmware also includes the ability to disable the FTP server. This updated firmware can be downloaded at: http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/?showAsIframe... http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/

Event History

Jan 27, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-9198?

CVE-2014-9198 has a medium severity level due to the presence of hardcoded credentials that can be exploited by remote attackers.

How do I fix CVE-2014-9198?

To fix CVE-2014-9198, update the ETG3000 FactoryCast HMI Gateway firmware to a version after 1.60 IR 04 that corrects the hardcoded credential issue.

What systems are affected by CVE-2014-9198?