CVE-2017-5178
First published: Wed Mar 08 2017(Updated: )
An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tableau Desktop | =7.0 | |
| Tableau Desktop | =10.1.3 | |
| Tableau Server | =7.0 | |
| Tableau Server | =10.1.3 | |
| Wonderware Intelligence | <=2014 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-5178?
CVE-2017-5178 is classified as a medium severity vulnerability due to the presence of a default system account with default credentials.
How do I fix CVE-2017-5178?
To fix CVE-2017-5178, configure the default system account with non-default credentials and ensure proper access controls are in place.
Which versions are affected by CVE-2017-5178?
CVE-2017-5178 affects Schneider Electric Tableau Server/Desktop versions 7.0 to 10.1.3 and Wonderware Intelligence versions 2014R3 and prior.
What type of software is affected by CVE-2017-5178?
CVE-2017-5178 affects industrial automation software including Schneider Electric Tableau Server/Desktop and Wonderware Intelligence.
Is there a known exploit for CVE-2017-5178?
While there may not be a widely reported exploit, the vulnerability presents a significant risk due to the presence of default credentials.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/tableau desktop
- version/tableau desktop/7.0
- version/tableau desktop/10.1.3
- canonical/tableau server
- version/tableau server/7.0
- version/tableau server/10.1.3
- canonical/wonderware intelligence
- version/wonderware intelligence/2014