CVE-2014-2380

Published: Aug 28, 2014Modified: May 6, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

Affected (5)

Products: Invensys: Wonderware Information Server

Invensys

1 product

Wonderware Information Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Invensys Wonderware Information Server	Version 4.0 sp1
Invensys Wonderware Information Server	Version 4.0 sp1
Invensys Wonderware Information Server	Version 4.5
Invensys Wonderware Information Server	Version 5.0
Invensys Wonderware Information Server	Version 5.5

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json

Source: ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.