Details of VAR-201703-0660

ID

VAR-201703-0660

CVE

CVE-2017-5178

TITLE

Schneider Electric Wonderware Intelligence Electric Tableau Server/Desktop Default Credential Security Restriction Bypass Vulnerability

Trust: 1.0

sources: IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // CNVD: CNVD-2017-03075

DESCRIPTION

An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access. Schneider Electric Wonderware Intelligence is a set of industrial big data intelligent management solutions from Schneider Electric. The solution provides visual query and analysis capabilities for industrial big data. Electric Tableau Server/Desktop is the server side and the desktop. This may lead to further attacks. The following products are vulnerable: Wonderware Intelligence Tableau Analytics Dashboard Server 7.0 through 10.1.3 Wonderware Intelligence Tableau Analytics Client 7.0 through 10.1.3 Versions prior to Wonderware Intelligence Wonderware Intelligence 2014 R3

Trust: 2.97

sources: NVD: CVE-2017-5178 // JVNDB: JVNDB-2017-002291 // CNVD: CNVD-2017-03075 // BID: 96721 // IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // VULHUB: VHN-113381 // VULMON: CVE-2017-5178

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.0

sources: IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // CNVD: CNVD-2017-03075

AFFECTED PRODUCTS

vendor:	schneider electric	model:	tableau desktop	scope:	eq	version:	7.0	Trust: 1.6
vendor:	schneider electric	model:	tableau server	scope:	eq	version:	10.1.3	Trust: 1.6
vendor:	schneider electric	model:	tableau server	scope:	eq	version:	7.0	Trust: 1.6
vendor:	schneider electric	model:	tableau desktop	scope:	eq	version:	10.1.3	Trust: 1.6
vendor:	schneider electric	model:	wonderware intelligence	scope:	lte	version:	2014	Trust: 1.0
vendor:	schneider electric	model:	wonderware intelligence tableau analytics client	scope:	eq	version:	10.1.3	Trust: 0.9
vendor:	schneider electric	model:	wonderware intelligence tableau analytics client	scope:	eq	version:	7.0	Trust: 0.9
vendor:	schneider electric	model:	wonderware intelligence tableau analytics dashboard server	scope:	eq	version:	10.1.3	Trust: 0.9
vendor:	schneider electric	model:	wonderware intelligence tableau analytics dashboard server	scope:	eq	version:	7.0	Trust: 0.9
vendor:	schneider electric	model:	tableau desktop	scope:	eq	version:	7.0 to 10.1.3	Trust: 0.8
vendor:	schneider electric	model:	tableau server	scope:	eq	version:	7.0 to 10.1.3	Trust: 0.8
vendor:	schneider electric	model:	wonderware intelligence	scope:	lte	version:	2014r3	Trust: 0.8
vendor:	schneider electric	model:	wonderware intelligence tableau analytics client	scope:	eq	version:	0	Trust: 0.6
vendor:	schneider electric	model:	wonderware intelligence	scope:	eq	version:	2014	Trust: 0.6
vendor:	tableau desktop	model:	-	scope:	eq	version:	7.0	Trust: 0.4
vendor:	tableau desktop	model:	-	scope:	eq	version:	10.1.3	Trust: 0.4
vendor:	tableau server	model:	-	scope:	eq	version:	7.0	Trust: 0.4
vendor:	tableau server	model:	-	scope:	eq	version:	10.1.3	Trust: 0.4
vendor:	wonderware intelligence	model:	-	scope:	eq	version:	*	Trust: 0.4
vendor:	schneider electric	model:	wonderware intelligence wonderware intelligence	scope:	eq	version:	0	Trust: 0.3
vendor:	schneider electric	model:	wonderware intelligence wonderware intelligence r3	scope:	ne	version:	2014	Trust: 0.3
vendor:	schneider electric	model:	wonderware intelligence tableau analytics dashboard server	scope:	ne	version:	10.1.4	Trust: 0.3
vendor:	schneider electric	model:	wonderware intelligence tableau analytics client	scope:	ne	version:	10.1.4	Trust: 0.3

sources: IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // CNVD: CNVD-2017-03075 // BID: 96721 // JVNDB: JVNDB-2017-002291 // CNNVD: CNNVD-201703-353 // NVD: CVE-2017-5178

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-5178
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2017-5178
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2017-03075
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201703-353
value:	CRITICAL
Trust: 0.6
IVD:	7d7feb10-463f-11e9-8e54-000c29342cb1
value:	CRITICAL
Trust: 0.2
IVD:	b1597a71-b107-42ca-bd83-9cae3c1a9195
value:	CRITICAL
Trust: 0.2
VULHUB:	VHN-113381
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-5178
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-5178
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2017-03075
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d7feb10-463f-11e9-8e54-000c29342cb1
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	b1597a71-b107-42ca-bd83-9cae3c1a9195
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-113381
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-5178
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // CNVD: CNVD-2017-03075 // VULHUB: VHN-113381 // VULMON: CVE-2017-5178 // JVNDB: JVNDB-2017-002291 // CNNVD: CNNVD-201703-353 // NVD: CVE-2017-5178

PROBLEMTYPE DATA

problemtype:	CWE-1188	Trust: 1.0
problemtype:	CWE-255	Trust: 0.9

sources: VULHUB: VHN-113381 // JVNDB: JVNDB-2017-002291 // NVD: CVE-2017-5178

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-353

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201703-353

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-002291

PATCH

title:	LFSEC00000119	url:	http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000119/	Trust: 0.8
title:	Schneider Electric Wonderware Intelligence Electric Tableau Server/Desktop Default Credential Security Restricted Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/90673	Trust: 0.6
title:	Schneider Electric Wonderware Intelligence Electric Tableau Server/Desktop Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67840	Trust: 0.6
title:	Threatpost	url:	https://threatpost.com/privilege-escalation-flaw-patched-in-schneider-wonderware/124217/	Trust: 0.1

sources: CNVD: CNVD-2017-03075 // VULMON: CVE-2017-5178 // JVNDB: JVNDB-2017-002291 // CNNVD: CNNVD-201703-353

EXTERNAL IDS

db:	NVD	id:	CVE-2017-5178	Trust: 3.9
db:	ICS CERT	id:	ICSA-17-066-01	Trust: 3.5
db:	BID	id:	96721	Trust: 2.7
db:	CNNVD	id:	CNNVD-201703-353	Trust: 1.1
db:	CNVD	id:	CNVD-2017-03075	Trust: 1.0
db:	JVNDB	id:	JVNDB-2017-002291	Trust: 0.8
db:	IVD	id:	7D7FEB10-463F-11E9-8E54-000C29342CB1	Trust: 0.2
db:	IVD	id:	B1597A71-B107-42CA-BD83-9CAE3C1A9195	Trust: 0.2
db:	VULHUB	id:	VHN-113381	Trust: 0.1
db:	VULMON	id:	CVE-2017-5178	Trust: 0.1

sources: IVD: 7d7feb10-463f-11e9-8e54-000c29342cb1 // IVD: b1597a71-b107-42ca-bd83-9cae3c1a9195 // CNVD: CNVD-2017-03075 // VULHUB: VHN-113381 // VULMON: CVE-2017-5178 // BID: 96721 // JVNDB: JVNDB-2017-002291 // CNNVD: CNNVD-201703-353 // NVD: CVE-2017-5178

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-17-066-01	Trust: 3.6
url:	http://www.securityfocus.com/bid/96721	Trust: 1.8
url:	http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000119/	Trust: 1.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5178	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-5178	Trust: 0.8
url:	www.controlmicrosystems.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/1188.html	Trust: 0.1
url:	https://tools.cisco.com/security/center/viewalert.x?alertid=52969	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://threatpost.com/privilege-escalation-flaw-patched-in-schneider-wonderware/124217/	Trust: 0.1

sources: CNVD: CNVD-2017-03075 // VULHUB: VHN-113381 // VULMON: CVE-2017-5178 // BID: 96721 // JVNDB: JVNDB-2017-002291 // CNNVD: CNNVD-201703-353 // NVD: CVE-2017-5178

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 96721

SOURCES

db:	IVD	id:	7d7feb10-463f-11e9-8e54-000c29342cb1
db:	IVD	id:	b1597a71-b107-42ca-bd83-9cae3c1a9195
db:	CNVD	id:	CNVD-2017-03075
db:	VULHUB	id:	VHN-113381
db:	VULMON	id:	CVE-2017-5178
db:	BID	id:	96721
db:	JVNDB	id:	JVNDB-2017-002291
db:	CNNVD	id:	CNNVD-201703-353
db:	NVD	id:	CVE-2017-5178

LAST UPDATE DATE

2025-04-20T23:29:44.526000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-03075	date:	2017-03-22T00:00:00
db:	VULHUB	id:	VHN-113381	date:	2019-10-03T00:00:00
db:	VULMON	id:	CVE-2017-5178	date:	2021-06-04T00:00:00
db:	BID	id:	96721	date:	2017-03-16T01:00:00
db:	JVNDB	id:	JVNDB-2017-002291	date:	2017-04-10T00:00:00
db:	CNNVD	id:	CNNVD-201703-353	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-5178	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	IVD	id:	7d7feb10-463f-11e9-8e54-000c29342cb1	date:	2017-03-22T00:00:00
db:	IVD	id:	b1597a71-b107-42ca-bd83-9cae3c1a9195	date:	2017-03-22T00:00:00
db:	CNVD	id:	CNVD-2017-03075	date:	2017-03-22T00:00:00
db:	VULHUB	id:	VHN-113381	date:	2017-03-08T00:00:00
db:	VULMON	id:	CVE-2017-5178	date:	2017-03-08T00:00:00
db:	BID	id:	96721	date:	2017-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2017-002291	date:	2017-04-10T00:00:00
db:	CNNVD	id:	CNNVD-201703-353	date:	2017-03-09T00:00:00
db:	NVD	id:	CVE-2017-5178	date:	2017-03-08T08:59:00.160