Where
-Infinity
0

Trending

Last week
Last month
Last year

Schneider-electric ClearscadaA CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinte…

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)

First published (updated )
CVE-2023-0595

Schneider-electric Ecostruxure Geo Scada Expert 2019Infoleak

Risk 43
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. Affected Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022)

First published (updated )
CVE-2023-22611

Schneider-electric Ecostruxure Geo Scada Expert 2019A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against t…

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port.

First published (updated )
CVE-2023-22610

Schneider-electric ClearscadaA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could caus…

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

First published (updated )
CVE-2022-24321

Schneider-electric ClearscadaA CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle …

Risk 35
Severity
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

First published (updated )
CVE-2022-24320
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Schneider-electric ClearscadaA CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle …

Risk 35
Severity
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

First published (updated )
CVE-2022-24319

Schneider-electric ClearscadaWeak Encryption

Risk 43
Severity
7.5
Weak Encryption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)

First published (updated )
CVE-2022-24318

Schneider-electric ClearscadaUse of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all …

Risk 60
Severity
6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.

First published (updated )
CVE-2021-22741

Schneider-electric Ecostruxure Geo Scada Expert 2019A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert…

Risk 69
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.

First published (updated )
CVE-2020-28219

AVEVA ClearscadaSchneider Electric SCADA Expert ClearSCADA Cryptographic Issues

Risk 40
Severity
6.4
AV:N/AC:L/Au:N/C:N/I:P/A:N

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

Remedy

Asset owners should always obtain a signed web certificate from a certified authority before deploying ClearSCADA Web Server in a production environment. To assist asset owners who are currently using self-signed certificates, a standalone utility will be made available that can be used to generate and deploy a new self-signed certificate (signed using an SHA signing algorithm). This utility is recommended for existing ClearSCADA systems subject to this vulnerability, removing the need to upgrade the ClearSCADA software and perform a manual generation of a new certificate. This utility will be made available within the Software Downloads section of the following ClearSCADA Resource Center page: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support
First published (updated )
CVE-2014-5413
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

AVEVA ClearscadaSchneider Electric SCADA Expert ClearSCADA Cross-site Scripting

Risk 28
Severity
4.9
XSS
AV:N/AC:M/Au:S/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Remedy

Schneider Electric advises all ClearSCADA users to take steps to secure the interfaces to the ClearSCADA system. The ClearSCADA database security configuration should be reviewed and updated to limit all system access to authorized users only. The access permissions of existing users should be reduced to only those required by their role (e.g., removing any higher level System Administration privileges from Operations or Engineering users), and specific accounts should be created with appropriate permissions for performing System Administration tasks. Existing ClearSCADA customers using WebX can protect their system from cross-site scripting attacks by disabling the “Allow database shutdown via WebX” option within the ClearSCADA Server Configuration utility. Existing ClearSCADA customers should take measures to ensure their system does not grant any system access until users have supplied a valid username and password. Schneider Electric has corrected the default user security permissions; however, upgrading an existing vulnerable installation to a new version will not affect existing configured database security permissions. Therefore, the measures suggested here are strongly recommended for all users. Schneider Electric has corrected these vulnerabilities in the following service packs: * ClearSCADA 2010 R3.2, Released October 2014, and * SCADA Expert ClearSCADA 2014 R1.1, Released October 2014. If asset owners wish to upgrade to a new ClearSCADA Service Pack, please contact the local Schneider Electric office for the latest software version for ClearSCADA; alternatively, these new versions are available for direct download from the Schneider Electric web site. To update their license (not required when upgrading to a service pack of the same version), asset owners are required to complete and submit an online form, which is available here: http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update... http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update+Request+Form New Service packs for ClearSCADA are available for download here: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support General instructions on how to upgrade the ClearSCADA license (if required) are available here: http://resourcecenter.controlmicrosystems.com/display/CS/Updating+Your+ClearSCADA+License
First published (updated )
CVE-2014-5411

AVEVA ClearscadaSchneider Electric SCADA Expert ClearSCADA Improper Authentication

Risk 40
Severity
6.4
AV:N/AC:L/Au:N/C:P/I:N/A:N

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveraging access to the guest account.

Remedy

Schneider Electric advises all ClearSCADA users to take steps to secure the interfaces to the ClearSCADA system. The ClearSCADA database security configuration should be reviewed and updated to limit all system access to authorized users only. The access permissions of existing users should be reduced to only those required by their role (e.g., removing any higher level System Administration privileges from Operations or Engineering users), and specific accounts should be created with appropriate permissions for performing System Administration tasks. Existing ClearSCADA customers using WebX can protect their system from cross-site scripting attacks by disabling the “Allow database shutdown via WebX” option within the ClearSCADA Server Configuration utility. Existing ClearSCADA customers should take measures to ensure their system does not grant any system access until users have supplied a valid username and password. Schneider Electric has corrected the default user security permissions; however, upgrading an existing vulnerable installation to a new version will not affect existing configured database security permissions. Therefore, the measures suggested here are strongly recommended for all users. Schneider Electric has corrected these vulnerabilities in the following service packs: * ClearSCADA 2010 R3.2, Released October 2014, and * SCADA Expert ClearSCADA 2014 R1.1, Released October 2014. If asset owners wish to upgrade to a new ClearSCADA Service Pack, please contact the local Schneider Electric office for the latest software version for ClearSCADA; alternatively, these new versions are available for direct download from the Schneider Electric web site. To update their license (not required when upgrading to a service pack of the same version), asset owners are required to complete and submit an online form, which is available here: http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update... http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update+Request+Form New Service packs for ClearSCADA are available for download here: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support General instructions on how to upgrade the ClearSCADA license (if required) are available here: http://resourcecenter.controlmicrosystems.com/display/CS/Updating+Your+ClearSCADA+License
First published (updated )
CVE-2014-5412

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203