Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues
Summary
| CVE | CVE-2014-5413 |
|---|---|
| State | PUBLISHED |
| Assigner | icscert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-09-18 10:55:11 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:N/I:P/A:N
Problem Types: CWE-310 | CWE-310 CWE-310
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N | |
| 2.0 | [email protected] | Secondary | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | |
| 2.0 | CNA | CVSS | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
CVSS v2.0 Breakdown
AV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Aveva | Clearscada | 2010 | r3 | All | All |
| Application | Aveva | Clearscada | 2010 | r3.1 | All | All |
| Application | Aveva | Clearscada | 2013 | r1 | All | All |
| Application | Aveva | Clearscada | 2013 | r1.1 | All | All |
| Application | Aveva | Clearscada | 2013 | r1.1a | All | All |
| Application | Aveva | Clearscada | 2013 | r1.2 | All | All |
| Application | Aveva | Clearscada | 2013 | r2 | All | All |
| Application | Schneider-electric | Scada Expert Clearscada | 2013 | r2.1 | All | All |
| Application | Schneider-electric | Scada Expert Clearscada | 2014 | r1 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Schneider Electric | ClearSCADA | affected 2010 R3 (build 72.4560) | Not specified |
| CNA | Schneider Electric | ClearSCADA | affected 2010 R3.1 (build 72.4644) | Not specified |
| CNA | Schneider Electric | ClearSCADA | unaffected 2010 R3.2 | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R1 (build 73.4729) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R1.1 (build 73.4832) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R1.1a (build 73.4903) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R1.2 (build 73.4955) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R2 (build 74.5094) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2013 R2.1 (build 74.5192) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | affected 2014 R1 (build 75.5210) | Not specified |
| CNA | Schneider Electric | SCADA Expert ClearSCADA | unaffected 2014 R1.1 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a | [email protected] | www.cisa.gov | |
| Schneider Electric SCADA Expert ClearSCADA Vulnerabilities (Update A) | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | Third Party Advisory, US Government Resource |
| github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-25... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Aditya Sood (en)
Additional Advisory Data
Solutions
CNA: Asset owners should always obtain a signed web certificate from a certified authority before deploying ClearSCADA Web Server in a production environment. To assist asset owners who are currently using self-signed certificates, a standalone utility will be made available that can be used to generate and deploy a new self-signed certificate (signed using an SHA signing algorithm). This utility is recommended for existing ClearSCADA systems subject to this vulnerability, removing the need to upgrade the ClearSCADA software and perform a manual generation of a new certificate. This utility will be made available within the Software Downloads section of the following ClearSCADA Resource Center page: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support