Schneider Electric ETG3000 FactoryCast HMI Gateway Authentication Bypass Vulnerability

Bugtraq ID:	72258
Class:	Design Error
CVE:	CVE-2014-9198
Remote:	Yes
Local:	No
Published:	Jan 21 2015 12:00AM
Updated:	Apr 12 2019 07:00PM
Credit:	Narendra Shinde of Qualys Security
Vulnerable:	Schneider-Electric Tsxetg3022 - Schneider-Electric Tsxetg3021 - Schneider-Electric Tsxetg3010 - Schneider-Electric Tsxetg3000 - Schneider-Electric Etg3000 Factorycast Hmi Gateway Firmware 1.60.4 Schneider-Electric ETG3000 FactoryCast HMI Gateway TSXETG3022 Schneider-Electric ETG3000 FactoryCast HMI Gateway TSXETG3021 Schneider-Electric ETG3000 FactoryCast HMI Gateway TSXETG3010 Schneider-Electric ETG3000 FactoryCast HMI Gateway TSXETG3000 Schneider-Electric ETG3000 FactoryCast HMI Gateway 1.60 IR 04
Not Vulnerable:

Schneider Electric ETG3000 FactoryCast HMI Gateway Authentication Bypass Vulnerability

Schneider Electric ETG3000 FactoryCast HMI Gateway is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain unauthorized access to the affected device. This may aid in further attacks.

Schneider Electric ETG3000 FactoryCast HMI Gateway Authentication Bypass Vulnerability

Attackers can exploit this issue using readily available utilities.

Schneider Electric ETG3000 FactoryCast HMI Gateway Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Schneider Electric ETG3000 FactoryCast HMI Gateway Authentication Bypass Vulnerability

References:

• Schneider Electric Homepage (Schneider Electric)
  
• (ICSA-15-020-02) Schneider Electric ETG3000 FactoryCast HMI Gateway Vulnerabilit (ICS-CERT)