CVE-2015-0999: Infoleak
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0999?
CVE-2015-0999 is classified as a high severity vulnerability due to the exposure of sensitive credentials.
How do I fix CVE-2015-0999?
To fix CVE-2015-0999, upgrade to Schneider Electric InduSoft Web Studio version 7.1.3.4 SP3 Patch 4 or later.
What types of software are affected by CVE-2015-0999?
CVE-2015-0999 affects Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 prior to version 7.1.3.4 SP3 Patch 4.
What kind of information is exposed in CVE-2015-0999?
CVE-2015-0999 exposes cleartext OPC User credentials stored in a configuration file, allowing local users to access sensitive information.
Who is impacted by CVE-2015-0999?
Local users of affected Schneider Electric software can be impacted by CVE-2015-0999 due to the ability to read the configuration files.