CVE-2015-0996: Infoleak
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0996?
CVE-2015-0996 is considered a high severity vulnerability due to its potential to expose sensitive information through hardcoded cleartext passwords.
How do I fix CVE-2015-0996?
To fix CVE-2015-0996, update to Schneider Electric InduSoft Web Studio version 7.1.3.4 SP3 Patch 4 or later.
What kinds of sensitive information are affected by CVE-2015-0996?
CVE-2015-0996 can lead to unauthorized access to Project files and Project Configuration files containing sensitive information.
Who is affected by CVE-2015-0996?
CVE-2015-0996 affects users of Schneider Electric InduSoft Web Studio versions before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4.
Can local users exploit CVE-2015-0996?
Yes, local users can exploit CVE-2015-0996 to gain access to sensitive information due to the reliance on hardcoded cleartext passwords.