Multiple Schneider Electric Products CVE-2015-0997 Brute Force Authentication Bypass Vulnerability
BID:73386
Info
Multiple Schneider Electric Products CVE-2015-0997 Brute Force Authentication Bypass Vulnerability
| Bugtraq ID: | 73386 |
| Class: | Design Error |
| CVE: |
CVE-2015-0997 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2015 12:00AM |
| Updated: | Mar 26 2015 12:00AM |
| Credit: | Gleb Gritsai, Ilya Karpov, Kirill Nesterov, and Alisa Esage Shevcheckno |
| Vulnerable: |
Schneider-Electric InTouch Machine Edition 2014 7.1.3.2 Schneider-Electric InduSoft Web Studio 7.1.3.2 |
| Not Vulnerable: |
Schneider-Electric InduSoft Web Studio 7.1.3.4 SP 3 Patch 4 |
Discussion
Multiple Schneider Electric Products CVE-2015-0997 Brute Force Authentication Bypass Vulnerability
Multiple Schneider Electric products are prone to an authentication-bypass vulnerability.
Attackers can exploit this issue to bypass the authentication mechanism and log in to another user's account.
The following products are affected:
InduSoft Web Studio 7.1.3.2 and prior.
InTouch Machine Edition 7.1.3.2 and prior.
Multiple Schneider Electric products are prone to an authentication-bypass vulnerability.
Attackers can exploit this issue to bypass the authentication mechanism and log in to another user's account.
The following products are affected:
InduSoft Web Studio 7.1.3.2 and prior.
InTouch Machine Edition 7.1.3.2 and prior.