Schneider Electric Wonderware Input Validation
Summary
| CVE | CVE-2014-5398 |
|---|---|
| State | PUBLISHED |
| Assigner | icscert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-08-28 01:55:03 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
Risk And Classification
Primary CVSS: v2.0 2.1 from [email protected]
AV:L/AC:L/Au:N/C:P/I:N/A:N
Problem Types: CWE-20 | CWE-20 CWE-20
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 2.0 | [email protected] | Primary | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | |
| 2.0 | [email protected] | Secondary | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | |
| 2.0 | CNA | CVSS | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
CVSS v2.0 Breakdown
AV:L/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Invensys | Wonderware Information Server | 4.0 | sp1 | All | All |
| Application | Invensys | Wonderware Information Server | 4.0 | sp1 | All | All |
| Application | Invensys | Wonderware Information Server | 4.5 | - | portal | All |
| Application | Invensys | Wonderware Information Server | 5.0 | - | portal | All |
| Application | Invensys | Wonderware Information Server | 5.5 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Schneider Electric | Wonderware Information Server Portal | affected 4.0 SP1 | Not specified |
| CNA | Schneider Electric | Wonderware Information Server Portal | affected 4.5 | Not specified |
| CNA | Schneider Electric | Wonderware Information Server Portal | affected 5.0 | Not specified |
| CNA | Schneider Electric | Wonderware Information Server Portal | affected 5.5 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/news-events/ics-advisories/icsa-14-238-02 | [email protected] | www.cisa.gov | |
| github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-23... | [email protected] | github.com | |
| Schneider Electric Wonderware Vulnerabilities | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team (en)
Additional Advisory Data
Solutions
CNA: Schneider Electric has created an update for WIS web pages and components to address the vulnerabilities listed in this advisory. Customers using all versions of WIS are affected and should upgrade to WIS Version 5.5 and then apply the security update. Customers using the affected versions of WIS should set the security level settings in the Internet browser to “Medium – High” to minimize the risks presented by these vulnerabilities. In addition, the Wonderware Information Server Portal can be configured to use HTTPS that will require additional steps as documented in the products user documentation. Schneider Electric has released a security bulletin titled “Multiple Vulnerabilities in Wonderware Information Server LFSEC00000102” to announce the security update, which is available at the following location: https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000102.pdf