Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Schneider Electric SCADA Expert ClearSCADA < 2014 R1.1 and Schneider Electric ClearSCADA < 2010 R3.2 Multiple Vulnerabilities

Medium

Synopsis

A vulnerable version of Schneider Electric ClearSCADA has been detected.

Description

SCADA Expert ClearSCADA versions prior to 2014 R1.1 and ClearSCADA versions prior to 2010 R3.2 are affected by multiple vulnerabilities:

- Multiple web cross-site scripting vulnerabilities exist. A remote and authenticated user could execute arbitrary script code via unspecified vectors. (CVE-2014-5411)

- A remote authentication bypass vulnerability exists related to the guest user account. An attacker could gain read access to potentially sensitive information or bypass security restrictions to perform unauthorized actions. (CVE-2014-5412)

- A deprecated and weak signing algorithm (MD5) is used for X.509 certificates signed by ClearSCADA. Note that ClearSCADA users who do not use certificates signed by vulnerable versions of ClearSCADA and who have obtained an X.509 certificate signed by a valid Certificate Authority (CA) are not exposed to this vulnerability. (CVE-2014-5413)

Solution

Schneider Electric has fixed these vulnerabilities in SCADA Expert ClearSCADA version 2014 R1.1 and ClearSCADA version 2010 R3.2. Upgrade to SCADA Expert ClearSCADA version 2014 R1.1 or later, or ClearSCADA version 2010 R3.2 or later.