Sign-up

ID

VAR-201408-0101


CVE

CVE-2014-2380


TITLE

Schneider Electric Wonderware Information Server Vulnerability where important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2014-003981

DESCRIPTION

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file. Supplementary information : CWE Vulnerability types by CWE-326: Inadequate Encryption Strength ( Incorrect cipher strength ) Has been identified. http://cwe.mitre.org/data/definitions/326.htmlBy reading the authentication information file, a third party may obtain important information. Wonderware Information Server easily integrates factory performance metrics and operations, maintenance, and engineering production data collection and display through a network solution. Attackers use vulnerabilities to view encrypted data and obtain sensitive information. This may lead to other attacks. The program supports dashboards, pre-designed industrial activity reports, etc., and provides processes for analysis or write-back mechanisms

Trust: 2.7

sources: NVD: CVE-2014-2380 // JVNDB: JVNDB-2014-003981 // CNVD: CNVD-2014-05282 // BID: 69414 // IVD: 2928f826-2352-11e6-abef-000c29c66e3d // VULHUB: VHN-70319

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 2928f826-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05282

AFFECTED PRODUCTS

vendor:invensysmodel:wonderware information serverscope:eqversion:5.5

Trust: 1.6

vendor:invensysmodel:wonderware information serverscope:eqversion:4.5

Trust: 1.6

vendor:invensysmodel:wonderware information serverscope:eqversion:4.0

Trust: 1.6

vendor:invensysmodel:wonderware information serverscope:eqversion:5.0

Trust: 1.6

vendor:invensysmodel:wonderware information server sp1scope:eqversion:4.0

Trust: 0.9

vendor:invensysmodel:wonderware information server portalscope:eqversion:4.5

Trust: 0.9

vendor:invensysmodel:wonderware information serverscope:eqversion:portal 4.0 sp1 to 5.5

Trust: 0.8

vendor:wonderware information servermodel: - scope:eqversion:4.0

Trust: 0.4

vendor:wonderware information servermodel: - scope:eqversion:4.5

Trust: 0.2

vendor:wonderware information servermodel: - scope:eqversion:5.0

Trust: 0.2

vendor:wonderware information servermodel: - scope:eqversion:5.5

Trust: 0.2

sources: IVD: 2928f826-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05282 // BID: 69414 // JVNDB: JVNDB-2014-003981 // CNNVD: CNNVD-201408-428 // NVD: CVE-2014-2380

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-2380
value: HIGH

Trust: 1.0

NVD: CVE-2014-2380
value: HIGH

Trust: 0.8

CNVD: CNVD-2014-05282
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201408-428
value: HIGH

Trust: 0.6

IVD: 2928f826-2352-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

VULHUB: VHN-70319
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-2380
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-05282
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 2928f826-2352-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-70319
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 2928f826-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05282 // VULHUB: VHN-70319 // JVNDB: JVNDB-2014-003981 // CNNVD: CNNVD-201408-428 // NVD: CVE-2014-2380

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2014-003981 // NVD: CVE-2014-2380

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201408-428

TYPE

Design Error

Trust: 0.3

sources: BID: 69414

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003981

PATCH
title:Wonderware Information Serverurl:http://software.invensys.com/products/wonderware/production-information-management/information-server/
Trust: 0.8
title:Wonderware Information Server weak encryption vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/49430
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-05282 // 
            
            
            
            JVNDB: JVNDB-2014-003981

EXTERNAL IDS
db:NVDid:CVE-2014-2380
Trust: 3.7
db:ICS CERTid:ICSA-14-238-02
Trust: 3.1
db:BIDid:69414
Trust: 1.0
db:CNNVDid:CNNVD-201408-428
Trust: 0.9
db:CNVDid:CNVD-2014-05282
Trust: 0.8
db:JVNDBid:JVNDB-2014-003981
Trust: 0.8
db:IVDid:2928F826-2352-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:128111
Trust: 0.2
db:VULHUBid:VHN-70319
Trust: 0.1
sources:
            
            
            IVD: 2928f826-2352-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2014-05282 // 
            
            
            
            VULHUB: VHN-70319 // 
            
            
            
            BID: 69414 // 
            
            
            
            JVNDB: JVNDB-2014-003981 // 
            
            
            
            PACKETSTORM: 128111 // 
            
            
            
            CNNVD: CNNVD-201408-428 // 
            
            
            
            NVD: CVE-2014-2380

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-14-238-02
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2380
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2380
Trust: 0.8
url:http://www.securityfocus.com/bid/69414/discuss
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2014-5398
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-5399
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-5397
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2381
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2380
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-05282 // 
            
            
            
            VULHUB: VHN-70319 // 
            
            
            
            JVNDB: JVNDB-2014-003981 // 
            
            
            
            PACKETSTORM: 128111 // 
            
            
            
            CNNVD: CNNVD-201408-428 // 
            
            
            
            NVD: CVE-2014-2380

CREDITS
Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team
Trust: 0.3
sources:
            
            
            BID: 69414

SOURCES
db:IVDid:2928f826-2352-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2014-05282
db:VULHUBid:VHN-70319
db:BIDid:69414
db:JVNDBid:JVNDB-2014-003981
db:PACKETSTORMid:128111
db:CNNVDid:CNNVD-201408-428
db:NVDid:CVE-2014-2380

LAST UPDATE DATE
2025-04-13T23:04:56.242000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-05282date:2014-08-28T00:00:00
db:VULHUBid:VHN-70319date:2014-08-28T00:00:00
db:BIDid:69414date:2015-03-19T09:12:00
db:JVNDBid:JVNDB-2014-003981date:2014-08-29T00:00:00
db:CNNVDid:CNNVD-201408-428date:2014-08-29T00:00:00
db:NVDid:CVE-2014-2380date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:2928f826-2352-11e6-abef-000c29c66e3ddate:2014-08-28T00:00:00
db:CNVDid:CNVD-2014-05282date:2014-08-28T00:00:00
db:VULHUBid:VHN-70319date:2014-08-28T00:00:00
db:BIDid:69414date:2014-08-26T00:00:00
db:JVNDBid:JVNDB-2014-003981date:2014-08-29T00:00:00
db:PACKETSTORMid:128111date:2014-09-01T14:55:55
db:CNNVDid:CNNVD-201408-428date:2014-08-29T00:00:00
db:NVDid:CVE-2014-2380date:2014-08-28T01:55:03.123