CVE-2017-5155

Published: Feb 13, 2017Modified: May 13, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may be compromised as well.

Affected (1)

Products: Schneider Electric: Wonderware Historian

Schneider Electric

1 product

Wonderware Historian

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Wonderware Historian	Version 2014_r2_sp1_p01

Related CWEs

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (8)

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000115/

Source: ics-cert@hq.dhs.gov

Vendor Advisory

http://www.securityfocus.com/bid/95766

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037808

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-17-024-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000115/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/95766

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037808

Source: af854a3a-2127-422b-91ae-364da2661108

https://ics-cert.us-cert.gov/advisories/ICSA-17-024-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.